Univention Corporate Server (UCS) » SSL certificates

ID #1243

Using your own SSL certificates

As standard, certificates created by the UCS CA are used in UCS for the Apache, Postfix, Cyrus etc. daemons. As described in the following points, the Apache, Cyrus and Postfix services can be configured for the use of externally created certificates:

Apache

To use your own certificates for the web server Apache , the UCR variables apache2/ssl/certificate and apache2/ssl/key need to be set to the full path of the certificate files, e.g.:

ucr set apache2/ssl/certificate="/etc/myssl/cert.pem"
ucr set apache2/ssl/key="/etc/myssl/private.key"

The service must then be restarted for the changes to take effect:

/etc/init.d/apache2 restart

Cyrus

When configuring the SSL certificates for the IMAP server Cyrus, special attention must be paid to the fact that the files need to belong to the cyrus user and the mail group. It is thus recommended to create an additional copy of the certificates. Following the example above, the configuration could be performed as follows:

cp /etc/myssl/cert.pem /var/lib/cyrus/cert.pem
cp /etc/myssl/private.key /var/lib/cyrus/private.key
chown cyrus:mail /var/lib/cyrus/cert.pem /var/lib/cyrus/private.key
chmod 600 /var/lib/cyrus/cert.pem /var/lib/cyrus/private.key

The UCR variables mail/cyrus/ssl/certificate and mail/cyrus/ssl/key must then be set for Cyrus:

ucr set mail/cyrus/ssl/certificate="/var/lib/cyrus/cert.pem"
ucr set mail/cyrus/ssl/key="/var/lib/cyrus/private.key"

The Cyrus server finally needs to be restarted:

/etc/init.d/cyrus2.4 restart

Postfix:

The UCR variables mail/postfix/ssl/certificate and mail/postfix/ssl/key need to be configured:

ucr set mail/postfix/ssl/certificate="/etc/myssl/cert.pem"
ucr set mail/postfix/ssl/key="/etc/myssl/private.key"

Then the mail server has to be restarted:

/etc/init.d/postfix restart

Tags: -

Related entries:

Last update: 2014-01-06 12:39
Author: Moritz Mühlenhoff
Revision: 1.0

Digg it! Share on Facebook Print this record Send FAQ to a friend Show this as PDF file
Please rate this FAQ:

Average rating: 5 (2 Votes)

completely useless 1 2 3 4 5 most valuable

You cannot comment on this entry