Now that you have a valid key and certificate you are ready to set up your web server. You will need it for the Roundcube webmail interface and – if you like – the PHPMyAdmin database management interface.
The Apache web server installation on Debian stores all virtual host configurations in /etc/apache2/sites-available/. There are two files after a fresh Apache installation:
- 000-default.conf serves the /var/www directory via HTTP and is enabled by default. We will edit this file so that if a user accesses your web server via HTTP they will be redirected to the HTTPS site.
- default-ssl.conf serves the /var/www directory via HTTPS. It uses an automatically created self-signed “snake oil” certificate. We will enable this virtual host and configure the Roundcube webmail interface.
If you want to enable such a virtual host configuration you can use the “a2ensite” (Apache version 2 enable site) command. It will create a symbolik link from /etc/apache2/sites-available/FILE to /etc/apache2/sites-enabled/FILE.
Note: Debian Jessie ships with Apache version 2.4. This requires that all configuration files end with “.conf”. Expect confusing errors if you omit that suffix.
Virtual host for HTTPS
Edit the file /etc/apache2/sites-available/default-ssl.conf. Change these two lines to make Apache use the key and certificate you created earlier:
SSLCertificateFile /etc/ssl/certs/mailserver.pem SSLCertificateKeyFile /etc/ssl/private/mailserver.pem
Enable the SSL encryption module:
Enable the virtual host for HTTPS:
Reload the Apache:
service apache2 reload
Now if you point your web browser to https://YOURSERVER/ it will show the default Apache web page:
If you do not see that page please run “apache2ctl configtest” to see if Apache detects any obvious problems. Or check out the /var/log/apache2/error.log log file for error messages.
Set up HTTP to HTTPS redirection
For those users who forget to type “https” instead of “http” let us also set up an automatic redirection so that they will be forwarded to the secure URL. Edit the /etc/apache2/sites-available/000-default.conf file and insert
Redirect permanent / https://YOUR.MAIL.SERVER/
anywhere within the VirtualHost section. Of course you have to replace YOUR.MAIL.SERVER with the fully-qualified domain name of your mail server. Remove (or comment out) the “DocumentRoot” line here, too. This virtual host configuration is enabled by default so you just need to reload the web server to make your change work:
service apache2 reload
Now load the URL http://YOUR.MAIL.SERVER/ in your browser (HTTP – not HTTPS!) and verify that you are redirected to the HTTPS site.