How to add SSL withtout messing up your config for FREE

[j.waibel]

Another Tip:

Install a free startCom SSL certificate and install this in your server:

Below is my setup for my webmail setup (This is inside a virtualhost override for a domain to allow to have the webmail running at: https://webmail.jwd.de/

for the vhost overide see: Using Custom Vhost Entries for Webmail, MySQL, Etc.

Code:

</VirtualHost>

# Configuration for WebMail - webmail.jwd.de

Listen 80.83.120.44:443
<VirtualHost *:80>
   ServerName webmail.jwd.de
   Redirect permanent / https://webmail.jwd.de
</Virtualhost>

<VirtualHost 80.83.120.44:443>
   ServerAdmin webmaster[at]jwd.de
   DocumentRoot "/etc/sentora/panel/etc/apps/webmail/"
   ServerName webmail.jwd.de
    php_admin_value open_basedir "/etc/sentora/panel/etc/apps/webmail/:/etc/sentora/configs/roundcube/:/var/sentora/temp/"
    php_admin_value suhosin.executor.func.blacklist "passthru, show_source, shell_exec, system, pcntl_exec, popen, pclose, proc_open, proc_nice, proc_terminate, proc_get_status, proc_close, leak, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, escapeshellcmd, escapeshellarg, exec"


   AddType application/x-httpd-php .php3 .php
   <Directory /etc/sentora/panel/etc/apps/webmail/>
       Require all granted
       AllowOverride All
       <IfModule mod_php5.c>
               php_admin_flag engine on
       </IfModule>
   </Directory>
   SSLEngine on
   SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
   SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM;^M    SSLHonorCipherOrder on
   SSLCertificateFile /srv/hostdata/zadmin/ssl_certs/webmail_jwd_de/webmail.jwd.de.crt
   SSLCertificateKeyFile /srv/hostdata/zadmin/ssl_certs/webmail_jwd_de/webmail.jwd.de.pem
   SSLCertificateChainFile /srv/hostdata/zadmin/ssl_certs/startssl-class1-intermediate.crt

Please make sure you include "   SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2" in your ssl setup, because alot apache installations still enable the insecure SSLv3.

One more Tip:

Test if your SSL setup is correct by testing with https://www.ssllabs.com/ssltest/

J