​SSL feature - upcoming change in SSL certificate management

Dear community,

In the upcoming i-MSCP release (1.1.6), some changes will be made in the way the SSL certificates are managed.

Right now, it's not mandatory to provide a full CA chain in CA bundles. Because this can lead to numerous problems (depending of the SSL certificate type you are using), i-MSCP will now accept only the CA bundles which hold the full CA chain (root CA certificate and intermediate certificate(s)).

A concrete example is maybe needed to understand what we mean there:

For those which are using a positiveSSL certificate from comodo, they generally get a mail which contain the private key, their certificate and an intermediate certificate such as:

which represents a CA bundle containing a partial CA chain. Such CA bundle will not longer be accepted by i-MSCP. Instead, you'll have to provide the full CA chain (CA bundle containing the full CA chain) such as:

See here the CA root certificate (AddTrustExternalCARoot) added at bottom. This root CA come from https://support.comodo.com/ind…a=view&parentcategoryid=4

i-MSCP Team

Note: Those changes are already part of the last stable branch.

Also:

The control panel will now have it own SSL certificate. See https://github.com/i-MSCP/imsc…ba79691e0049dcce8eeca3872

SSL certificate container (PEM) for i-MSCP services (ftp,mail...) is now /etc/imscp/imscp_services.pem