[SM-USERS] HTTPS problem

[Machtelt G. <ti...@ga...>]

Dear co-squirrelmail users,

Since the dawn of times I've been using Squirrelmail.  Until I was
forced to upgrade to Apache2, all went well.  Since, I've googled myself
dizzy to get HTTPS working again, but no result.

I'll first give some more information about my system:

OS: Debian 5.0.1
Squirrelmail: squirrelmail (2:1.4.15-4+lenny2) 
Apache: apache2 (2.2.9-10+lenny2)
PHP: php5 (5.2.6.dfsg.1-1+lenny3)
IMAP: cyrus-imapd-2.2 (2.2.13-14+b3)
SMTP: postfix (2.5.5-1.1)
Browser: Iceweazel 2.0.0.19

All these out-of-the box installed with apt-get install.  Cyrus is from
unstable but I don't think that is the problem here, just mentioning it
because of the guidelines for this list.

What happens:

- Direct browser to http://mail.garrels.be -> all goes well.
- Direct browser to https://mail.garrels.be -> 
	Unable to connect
Iceweasel can't establish a connection to the server at mail.garrels.be.
    *   The site could be temporarily unavailable or too busy. Try again
        in a few moments.
    *   If you are unable to load any pages, check your computer's
        network connection.
    *   If your computer or network is protected by a firewall or proxy,
        make sure that Iceweasel is permitted to access the Web.

Of course, I am able to access other secure sites, like my homebanking
site.

I've already contacted my local Linux user group for this, and they told
me that my server listens on both port 80 and port 443, but that it
speaks http on both, and not http on port 80 and https on port 443.

Now, I tried to make things better by installing the secure_login plugin
- this is the only extra plugin I installed apart from the standard
plugins that come with my squirrelmail package, it is version 1.4-1.  Of
course, since https does not work, nothing now works for squirrelmail.

SSL and rewrite modules are enabled in Apache.

I run lots of virtual hosts on this machine.  None of them have the need
for HTTPS (I use SSH tunnels for secure access for adminning, but I
can't expect my mailusers to do that).

Given all this info, I started - using various sources - to configure
apache for SSL.  I did the following:

- Create certificate:
openssl req -new -x509 -days 365 -nodes -out /etc/apache2/ssl/apache.pem
-keyout /etc/apache2/ssl/apache.pem

I've tried various other ways to create a cert, but those asked me to
enter a passphrase when restarting apache2, and since I never entered a
passphrase to create the certs, I was at a loss and apache2 didn't
restart and none of my sites where accessible.

- Edit /etc/apache2/sites-available/default:
NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:80>
 ->all the normal stuff
<VirtualHost *:443>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error,
        # crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLCertificateFile /etc/apache2/ssl/apache.pem
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

</VirtualHost>

- Made a link in /etc/apache2/sites-enabled

- Edited /etc/apache2/sites/available/mail.garrels.be
<Directory /usr/share/squirrelmail>
  Options Indexes FollowSymLinks
  <IfModule mod_php4.c>
    php_flag register_globals off
  </IfModule>
  <IfModule mod_php5.c>
    php_flag register_globals off
  </IfModule>
  <IfModule mod_dir.c>
    DirectoryIndex index.php
  </IfModule>

  # access to configtest is limited by default to prevent information
  # leak
  <Files configtest.php>
    order deny,allow
    deny from all
    allow from 127.0.0.1
  </Files>
</Directory>
<VirtualHost *:80>
  DocumentRoot /usr/share/squirrelmail
  ServerName mail.garrels.be
    ErrorLog /var/log/apache2/mail.garrels.be-error.log
    CustomLog /var/log/apache2/mail.garrels.be-access.log combined
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/apache.pem
</VirtualHost>

And various variations on that theme, like adding a block VirtualHost
*:443> etc.

- Restarted Apache2 at each change.

If anybody sees what I am doing wrong, I'll be glad to hear it.  It is
probably something stupid, so tell me and out of shame I will never
forget again.  If you need more info, I'll be glad to provide it.

Sorry for the long post, thanks for your attention so far.

Machtelt.


-- 
Your freedom is only limited by mine.	http://www.garrels.be
Books:					http://writers.fultus.com/garrels