Some of you don’t know this but I run Freecpanelsharedhosting.com as a project for Lowendspirit.com and have a successful cPanel server in Miami, Florida. After talking with Anthony (owner of Inception Hosting) we mutually decided to expand to the Netherlands, this time using VestaCP as the control panel dispite the name in the url. 🙂 After the initial testing it was time to get a valid externally signed certificate for the Control Panel itself and since Namecheap offered cheap PositiveSSL with new domains I had one left that could be used for this occasion.
Creating the CSR (Certificate Signing Request)
First thing first, create the request that we should send to Namecheap. Running this command will ask you a few questions in return, be truthful when answering. If asked for a password, leave it empty.
|
1 |
openssl req -new -newkey rsa:2048 -nodes -keyout nl01.freecpanelsharedhosting.com.key -out nl01.freecpanelsharedhosting.com.csr |
As you can see I have nl01.freecpanelsharedhosting.com in the commandline since that is the domain I will be requesting a cetificate for. Change this to the domain name that you own and will request at certificate for. In that same directory that you ran the above command you will now find a .csr file (in my case named:
|
1 |
nl01.freecpanelsharedhosting.com.csr |
This file has the information that you need to paste into the Namecheap order form for a new certificate. i will not go into the details on how to order the Certificate on the namecheap website, instead lets jump to the point when you recieve the certificate in your email.
Install the new certificate
In that email there should be a ZIP-file containg four files:
- AddTrustExternalCARoot.crt
- COMODORSAAddTrustCA.crt
- COMODORSADomainValidationSecureServerCA.crt
- nl01.freecpanelsharedhosting.com.crt
Save all files in the /usr/local/vesta/ssl/ directory and also copy the key file that was created at the same time as the csr file to that directory.
The config file for VestaCP that we need to edit to change the certificate is named
|
1 |
/usr/local/vesta/nginx/conf/nginx.conf |
But before we edit that file we need to do two things, combine the certificate for our domain name and the intermidiate certificates into one file and change the permissions of two files.
Combine three of the received files into one by using this command:
|
1 |
cat nl01.freecpanelsharedhosting.com.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > nl01.freecpanelsharedhosting.com.pem |
Make sure you update the command to use the name of your certificate.
Edit the Vesta config file:
|
1 |
nano /usr/local/vesta/nginx/conf/nginx.conf |
find the SSL Certificate section
|
1 2 |
ssl_certificate /usr/local/vesta/ssl/certificate.crt; ssl_certificate_key /usr/local/vesta/ssl/certificate.key; |
Comment the two lines and add your own certificate, it should look something like this:
|
1 2 3 4 |
#ssl_certificate /usr/local/vesta/ssl/certificate.crt; #ssl_certificate_key /usr/local/vesta/ssl/certificate.key; ssl_certificate /usr/local/vesta/ssl/nl01.freecpanelsharedhosting.com.pem; ssl_certificate_key /usr/local/vesta/ssl/nl01.freecpanelsharedhosting.com.key; |
Change the owner on the two files that you added to the Vesta config file
|
1 |
chown root:mail nl01.freecpanelsharedhosting.com.key |
|
1 |
chown root:mail nl01.freecpanelsharedhosting.com.pem |
restart Vesta
|
1 |
/etc/init.d/vesta restart |
Look for potential errors, if you can’t fix them yourself, comment out the newly added rows in
|
1 |
/usr/local/vesta/nginx/conf/nginx.conf |
and restart VestaCP again to go back to the self-signed certificates. Post your error messages in the comments below and I’ll do my best to assist you.
If you have a tab open in your web browser to your control panel login page, close and reopen it. You should now see that your login page uses the bought certificate.
9 comments for “Install PositiveSSL for the VestaCP login page”