how to secure aapanel dashboard

aaP_shaj_shajin

Hi team,

My aapanel dashboard on the Browser shows (Not secure).

How can I secure the Aapanel dashboard?

Thanks!

dustincudd

Have you pressed the "set" button next to the "Panel SSL" selection and put in a valid SSL certificate and key?

That warning is telling you that the SSL certificate is not technically valid, the default is self signed and just there for your to get started, you'll need to put in your own valid SSL certificate for the domain you'll be accessing the panel via.

aaP_shaj_shajin

dustincudd

Yes, I have pressed "set" button and sucessfully saved the SSL. Attached is the secrrenshot.

Note: It is using the same website SSL key.

dustincudd

aaP_shaj_shajin I think when I did mine, to get it to apply, I had to restart the service...

Give "service bt restart" a go, barring that, modern browsers just don't seem to like to update the status of a cert once an exception is given, you can try another browser real quick or if you've got another system with OpenSSL installed you can use it as a client real quick to see if you get a valid response via:

openssl s_client -connect somewebaddress.thetldhere:7800

obviously replace it with your site address and the port number format is 7800 in that example, same as the default install...

aaP_shaj_shajin

dustincudd

I have restarted the service using the below command

etc/init.d/bt restart

but after restarting also am having the same issue.

Note: I don't have any other system to check this.

dustincudd

aaP_shaj_shajin I have a feeling what was entered in there isn't right, looking at the screenshots a bit more closely the certificate doesn't match between them: one starts with "MIIFPT" the other starts with "MIICpj".

You'd need to copy the private key and certificate from the Lets Encrypt tab/window to the Custom Panel Certificate window then restart the service.

Both the private key and certificate should be the same in both those screenshots if you are trying to use that domain name for access to the panel via SSL.

I do see the address, and I could load port 7800 real quick to see what cert it responds with if you like.

aaP_shaj_shajin

dustincudd

Yes u can check that...

I also pasted the same key from the let's encrypt and restarted the service

dustincudd

aaP_shaj_shajin Alright, I took a quick look... and its still serving the self signed certificate that's in that second screenshot:

CONNECTED(00000003)
depth=0 CN = 144.24.<IP removed>
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = 144.24.<IP removed>

verify return:1

Certificate chain
0 s:CN = 144.24.<IP removed>

i:CN = 144.24.<IP Removed>

Server certificate
-----BEGIN CERTIFICATE-----
MIICpjCCAY4CAQAwDQYJKoZIhvcNAQEEBQAwGTEXMBUGA1UEAwwOMTQ0LjI0LjEz
OC4xNjEwHhcNMjIwOTI0MDQyNDE5WhcNMzIwOTIxMDQyNDE5WjAZMRcwFQYDVQQD<full cert truncated>

Want to double check the Panel Certificate again? Its still responding with this old cert, you can see the start of it above ... it should respond with a hash that starts with this like in the first screenshot:

-----BEGIN CERTIFICATE-----
MIIFPTCCBCWgAwIBAgISA77ysQ2w7DNnP3XkV2yFHjzOMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD

aaP_shaj_shajin

added the same key. you can double check the Panel Certificate again..

dustincudd

aaP_shaj_shajin Same response, restart the service real quick if you haven't? If you have, might need the devs to explain where the cert is actually held in the file system to change it manually... I suppose I could go hunting for it if I have time too.

aaP_shaj_shajin

Thanks! Restarted the service. can u tell me whether this command is correct "/etc/init.d/bt restart"

dustincudd

aaP_shaj_shajin Same thing, lets look at this...

So from what I can tell, if you go to the following path:

/www/server/panel/ssl

You should find 3 files, only 2 are relevant though, and they are:

certificates.pem
and
privatekey.pem

Those 2 files should be as far as I can tell what the aaPanel its self is using for SSL certificates, if you take a look at those files and they're not the same content you have in the text boxes in the web interface, that would be a problem, you could just put the private key and certificate in that file (back up the existing self signed in case something goes wrong using something like.... "cp certificate.pem certificate.bak" and same for the private key, etc)

So lets see if the contents of those files are even what they're supposed to be, I have a feeling the might still be the old self signed certificates... if they're right.... well something isn't going right with restarting the service, it sounds like you are on Centos/Fedora since you are making direct Init.d calls, I'm on Ubuntu... haven't used a Redhat/CentOS base in a while but it seems correct to me? Worst comes to worst, restart the server, that'll certainly force the service to restart 😉

aaP_shaj_shajin

dustincudd

OH HEY! Its working now! I just retested it after your last screenshot and its correct now! 🙂

aaP_shaj_shajin

both the certificates.pem and privatekey.pem files have the same key as let's encrypt.

Is it working? I can see the same error "Not secure" in my browser

dustincudd

aaP_shaj_shajin Yeah its working AOK on my end:

root @redacted:/# openssl s_client -connect tu<removedURL>ag.com:7800

CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = www.tu<removedurl>ag.com

verify return:1

Certificate chain
0 s:CN = www.tu<removedURL>ag.com
i:C = US, O = Let's Encrypt, CN = R3
1 s:C = US, O = Let's Encrypt, CN = R3
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1

i: O = Digital Signature Trust Co., CN = DST Root CA X3

Server certificate
-----BEGIN CERTIFICATE-----
MIIFPTCCBCWgAwIBAgISA77ysQ2w7DNnP3XkV2yFHjzOMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA5MjUwNjUxNDlaFw0yMjEyMjQwNjUxNDhaMB4xHDAaBgNVBAMT
E3d3dy50dXRvcmlhbGJhZy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK

Seems good here, I see a LetsEncrypt cert on the browser and OpenSSL sees the same thing on port 7800, lookin' good now.

For the record I'm not an employee here, etc, just some dude who's browsing around the forums after reporting a bug and decided to help.

aaP_shaj_shajin

Ok ok... Thanks a lot for ur time..