July 2014 - My Blog

Here’s how I install SSL certificates for Horde and Roundcube bundled with Plesk 12.0.18 to remove chain issues, and keep the certificate in scope of Plesk backups.

INSTALL

Firstly, install your webmail certificate in…

Plesk -> Tools & Settings -> SSL Certificates

1	Plesk -> Tools & Settings -> SSL Certificates

And then go to…

Plesk -> Tools & Settings -> Database Servers -> PHPMyAdmin -> psa -> certificates

1	Plesk -> Tools & Settings -> Database Servers -> PHPMyAdmin -> psa -> certificates

Get the file names for the webmail certificate and CA certificate and make a custom horde and roundcube template (paths to follow) adding the following directives.

THE DIRECTIVES

Apache files (horde.php and roundcube.php)

SSLCertificateKeyFile "/opt/psa/var/certificates/cert-name"
SSLCertificateFile "/opt/psa/var/certificates/cert-name"
SSLCACertificateFile "/opt/psa/var/certificates/ca-name"

SSLCertificateKeyFile "/opt/psa/var/certificates/cert-name"

SSLCertificateFile "/opt/psa/var/certificates/cert-name"

SSLCACertificateFile "/opt/psa/var/certificates/ca-name"

Nginx File (nginxWebmailPartial.php)

ssl_certificate             /opt/psa/var/certificates/cert-name;
ssl_certificate_key         /opt/psa/var/certificates/cert-name;
ssl_client_certificate      /opt/psa/var/certificates/ca-name;

ssl_certificate /opt/psa/var/certificates/cert-name;

ssl_certificate_key /opt/psa/var/certificates/cert-name;

ssl_client_certificate /opt/psa/var/certificates/ca-name;

I do this because the CA directives are missing from the default Apache2 templates.

TEMPLATE LOCATION

Templates are located here..

/opt/psa/admin/conf/templates/default/horde.php
/opt/psa/admin/conf/templates/default/roundcube.php
/opt/psa/admin/conf/templates/default/nginxWebmailPartial.php

/opt/psa/admin/conf/templates/default/horde.php

/opt/psa/admin/conf/templates/default/roundcube.php

/opt/psa/admin/conf/templates/default/nginxWebmailPartial.php

copy the above files to

/opt/psa/admin/conf/templates/custom

1	/opt/psa/admin/conf/templates/custom

and then edit the files..

EDITING THE TEMPLATES

You need to find and replace the SSL directive/s in the template files and replace with the ones above.

horde.php line 83, and roundcube.php line 86

SSLCertificateFile "<?php echo $ipAddress->sslCertificate->ceFilePath ?>"

1	SSLCertificateFile "<?php echo $ipAddress->sslCertificate->ceFilePath ?>"

become…

SSLCertificateKeyFile "/opt/psa/var/certificates/cert-name"
SSLCertificateFile "/opt/psa/var/certificates/cert-name"
SSLCACertificateFile "/opt/psa/var/certificates/ca-name"

SSLCertificateKeyFile "/opt/psa/var/certificates/cert-name"

SSLCertificateFile "/opt/psa/var/certificates/cert-name"

SSLCACertificateFile "/opt/psa/var/certificates/ca-name"

nginxWebmailPartial.php, there’s a big chunk you need to remove, lines 10 to 26 (in your file)…

<?php if ($OPT['ssl']): ?>
<?php $sslCertificate = $ipAddress->sslCertificate; ?>
<?php   if ($sslCertificate->ce): ?>
    ssl_certificate             <?php echo $sslCertificate->ceFilePath ?>;
    ssl_certificate_key         <?php echo $sslCertificate->ceFilePath ?>;
<?php       if ($sslCertificate->ca): ?>
    ssl_client_certificate      <?php echo $sslCertificate->caFilePath ?>;
<?php       endif ?>
    ssl_session_timeout         5m;

<?php if (get_param('disablesslv3')): ?>
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
<?php else: ?>
    ssl_protocols               SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2;
<?php endif ?>
    ssl_ciphers                 HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;
<?php   endif ?>
<?php endif ?>

<?php if ($OPT['ssl']): ?>

<?php $sslCertificate = $ipAddress->sslCertificate; ?>

<?php if ($sslCertificate->ce): ?>

ssl_certificate <?php echo $sslCertificate->ceFilePath ?>;

ssl_certificate_key <?php echo $sslCertificate->ceFilePath ?>;

<?php if ($sslCertificate->ca): ?>

ssl_client_certificate <?php echo $sslCertificate->caFilePath ?>;

<?php endif ?>

ssl_session_timeout 5m;

<?php if (get_param('disablesslv3')): ?>

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

<?php else: ?>

ssl_protocols SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2;

<?php endif ?>

ssl_ciphers HIGH:!aNULL:!MD5;

ssl_prefer_server_ciphers on;

<?php endif ?>

Becomes something like…

<?php if ($OPT['ssl']): ?>
    ssl_ecdh_curve              secp384r1;
    ssl_dhparam                 /etc/ssl/dh/RSA4096.pem;
    
    ssl_certificate             /opt/psa/var/certificates/cert-name;
    ssl_certificate_key         /opt/psa/var/certificates/cert-name;
    ssl_client_certificate      /opt/psa/var/certificates/ca-name;
    
    ssl_session_timeout                           5m;
    ssl_session_cache                  shared:SSL:5m;
    
    ssl_prefer_server_ciphers                     on;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;   
    ssl_ciphers             EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate     /etc/ssl/ocsp/domainCA.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 10s;
    
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
<?php endif ?>

<?php if ($OPT['ssl']): ?>

ssl_ecdh_curve secp384r1;

ssl_dhparam /etc/ssl/dh/RSA4096.pem;

ssl_certificate /opt/psa/var/certificates/cert-name;

ssl_certificate_key /opt/psa/var/certificates/cert-name;

ssl_client_certificate /opt/psa/var/certificates/ca-name;

ssl_session_timeout 5m;

ssl_session_cache shared:SSL:5m;

ssl_prefer_server_ciphers on;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

ssl_stapling on;

ssl_stapling_verify on;

ssl_trusted_certificate /etc/ssl/ocsp/domainCA.pem;

resolver 8.8.8.8 8.8.4.4 valid=300s;

resolver_timeout 10s;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

<?php endif ?>

You can see I have also added ssl_session_cache in there along with HSTS, OCSP, dhparam and ECDH Curve.
Now regenerate the conf files with…

/opt/psa/admin/bin/httpdmng --reconfigure-all

1	/opt/psa/admin/bin/httpdmng --reconfigure-all

Your webmail will now be properly secured and you won’t get any chain issues when testing your site at ssllabs.

Please note CentOS paths are different. The psa folder is located in /usr/local/.

Thanks for reading, I am working on formatting this article better so you can copy and paste directives like previous guides, unfortunately the code tags wouldn’t wrap the above php sections.

Here’s a guide on adding OCSP to your Plesk 11.5.30 or Plesk 12.0.18 Panel.
Firstly you need to create a file containing both your intermediate and CA certificate, lets call it domainCA.pem.
create the folder…

mkdir /etc/ssl/ocsp/

1	mkdir /etc/ssl/ocsp/

and upload domainCA.pem to it.

Now create a file called ocsp.inc in

/etc/sw-cp-server/conf.d/ocsp.inc

1	/etc/sw-cp-server/conf.d/ocsp.inc

and add the following nginx directives to it…

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/ocsp/domainCA.pem;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

ssl_stapling on;

ssl_stapling_verify on;

ssl_trusted_certificate /etc/ssl/ocsp/domainCA.pem;

resolver 8.8.4.4 8.8.8.8 valid=300s;

resolver_timeout 10s;

Next you need to add an include statement for ocsp.inc in the plesk.conf file…

/etc/sw-cp-server/conf.d/plesk.conf

1	/etc/sw-cp-server/conf.d/plesk.conf

Like so…

include conf.d/*ocsp.inc;

1	include conf.d/*ocsp.inc;

With the other include directives.

And restart the Plesk server with

service sw-cp-server restart

1	service sw-cp-server restart

You now have OCSP on your Plesk Panel.

You can also add these directives on a per domain basis in the Plesk Panel under

Plesk -> Domains -> yourdomain.tld -> Apache & Nginx Settings -> Additional nginx directives

My Blog

Monthly Archives: July 2014

Secure Plesk Webmail

Add OCSP to Plesk Panel

Add HSTS to Plesk Panel

Servers and Security