Now that you have a valid key and certificate you are ready to set up your web server. You will need it for the Roundcube webmail interface and – if you like – the PHPMyAdmin database management interface.
The Apache web server installation on Debian stores all virtual host configurations in /etc/apache2/sites-available/. There are two files after a fresh Apache installation:
- 000-default.conf serves the /var/www directory via HTTP and is enabled by default. We will edit this file so that if a user accesses your web server via HTTP they will be redirected to the HTTPS site.
- default-ssl.conf serves the /var/www directory via HTTPS. It uses an automatically created self-signed “snake oil” certificate. We will enable this virtual host and configure the Roundcube webmail interface.
If you want to enable such a virtual host configuration you can use the “a2ensite” (Apache version 2 enable site) command. It will create a symbolik link from /etc/apache2/sites-available/FILE to /etc/apache2/sites-enabled/FILE.
Note: Debian Jessie ships with Apache version 2.4. This requires that all configuration files end with “.conf”. Expect confusing errors if you omit that suffix.
Virtual host for HTTPS
Edit the file /etc/apache2/sites-available/default-ssl.conf. Change these two lines to make Apache use the key and certificate you created earlier:
SSLCertificateFile /etc/ssl/certs/mailserver.pem SSLCertificateKeyFile /etc/ssl/private/mailserver.pem
Enable the SSL encryption module:
a2enmod ssl
Enable the virtual host for HTTPS:
a2ensite default-ssl
Reload the Apache:
service apache2 reload
Now if you point your web browser to https://YOURSERVER/ it will show the default Apache web page:
If you do not see that page please run “apache2ctl configtest” to see if Apache detects any obvious problems. Or check out the /var/log/apache2/error.log log file for error messages.
Set up HTTP to HTTPS redirection
For those users who forget to type “https” instead of “http” let us also set up an automatic redirection so that they will be forwarded to the secure URL. Edit the /etc/apache2/sites-available/000-default.conf file and insert
Redirect permanent / https://YOUR.MAIL.SERVER/
anywhere within the VirtualHost section. Of course you have to replace YOUR.MAIL.SERVER with the fully-qualified domain name of your mail server. Remove (or comment out) the “DocumentRoot” line here, too. This virtual host configuration is enabled by default so you just need to reload the web server to make your change work:
service apache2 reload
Now load the URL http://YOUR.MAIL.SERVER/ in your browser (HTTP – not HTTPS!) and verify that you are redirected to the HTTPS site.
What about defining the location of the chain cert?
@Correy: Just put the chain cert and the actual cert into the same file.
First of all, great tutorial! I have followed it last year and my mailserver is still rocking solid. I have one question though, what about including nginx as the webserver? From my experiences it uses less resources and (I find it to be) easier to set up.
Thanks!
@Krik: There are so many different components. I prefer PostgreSQL and nginx to MySQL and Apache. If you need directions to use Roundcube with nginx then let me know and I will post my configuration.
Thanks for your reply,
It would be awesome if you could post your configuration. Maybe it will also be useful for other readers.
Instead of simply redirecting / to the https side, why not rewrite the requests and redirect?
Instead of your line
Redirect permanent / https://YOUR.MAIL.SERVER/
enable the rewrite module (a2enmod rewrite) and use this inside the host declaration?
RewriteEngine on
RewriteCond %{HTTPS} !^on$ [NC]
RewriteRule . https://%{HTTP_HOST}%{REQUEST_URI} [L]
Because this is not recommended. See: https://wiki.apache.org/httpd/RewriteHTTPToHTTPS
Sorry for my dummy question:
Where is the “/etc/ssl/certs/mailserver.pem” come from? I follow the steps, and under /etc/ssl/certs ONLY has a mailserver.scr.
Sorry again, I am using Option 3 to get key and cert.