SSLCACertificateFile in virtual servers and Authenticated Origin Pulls (mTLS) from Cloudflare

Virtualmin
1
SYSTEM INFORMATION
OS type and version Rocky Linux 9.7
Webmin version 2.610
Virtualmin version 7.50.2 Professional
Webserver version Apache version 2.4.62

Hello,

I have configured Authenticated Origin Pulls (mTLS) from Cloudflare in my virtual servers (Zone-level authenticated origin pulls · Cloudflare SSL/TLS docs), and i put these in the Apache virtual server configuration (also, I deleted /home/user_name/ssl.ca):

SSLCACertificateFile /etc/ssl/cloudflare/authenticated_origin_pull_ca.pem
SSLVerifyClient require

All is ok, and works, but when I renewed the Let’s Encrypt certificate, Virtualmin recreated the file.

/home/user_name/ssl.ca

in the Apache .conf, and delete SSLCACertificateFile /etc/ssl/cloudflare/authenticated_origin_pull_ca.pem. Then, the connection with Cloudflare is lost.

Also, in the menu SSL Certificate > Current Certificate I see this: ** SSL CA cert for CloudFlare, Inc./origin-pull.cloudflare.net does not match the issuer of the SSL cert Let’s Encrypt/R12* when the authenticated_origin_pull_ca.pem is active.

How can I avoid this? Changing the template file in Virtualmin for SSL?

Thank you very much!

2

@Ilia @Jamie I thought we’d fixed this issue a few versions ago? Virtualmin should not be setting SSLCACertificateFile at all for basic TLS.

3

Before having the Cloudflare configuration, I had:

SSLEngine on
SSLCertificateFile /home/user/ssl.cert
SSLCertificateKeyFile /home/user/ssl.key
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCACertificateFile /home/user/ssl.ca

In the Apache config.

Virtualmin was installed over 10 years ago, so may I still have some legacy configuration?

4

That seems likely. But, it still shouldn’t happen. There’s no reason for it to be there in a Virtualmin TLS configuration. It does nothing.

You can explicitly override the Virtualmin VirtualHost configuration in Server Templates, but I think that means you have to replace everything, which isn’t a great compromise. This is just a bug we need to fix, and I really thought we had fixed it…a few times.

5

Yes, but it’s not implemented yet. @Jamie said he’s working on it.

1 Like
6

Thanks!

I’ll wait for the new version to implement the Cloudflare option.