Webmin admin over SSL with Let's Encrypt cert (SOLVED)

ergophobe · October 20, 2017, 5:11am

I just installed Ubuntu 16.04 LTS and Virtualmin/Webmin via the Virtualmin full stack install script.

I can already access Webmin and a test page on the same host over SSL, but I can’t get rid of the browser warning for Webmin (the web page using the same hostname does work fine using a Let’s Encrypt cert). I only created the Apache virtual host with the same name to see if that would help recognize the cert.

I have tried to use a Let’s Encrypt certificate, but the browser keeps saying that I have a self-signed cert.

So I have
hostname.example.tld - I can access a webpage on this domain via https with no warnings.
hostname.example.tld:10000 to access Webmin gives me an security warning.

When I open the SSL Settings tab, it is populated with the letsencrypt key, cert an ca


Enable SSL: Yes
Private key file: /etc/webmin/letsencrypt-key.pem
Certificate file: /etc/webmin/letsencrypt-cert.pem
Redirect non-SSL to SSL: No
SSL protocol version: Detect automatically
SSL versions to reject: only TLSv1.2 is unchecked (i.e. allowed)
Allow compressed SSL connections: No
Force use of server-defined cipher order: Yes
Allowed SSL Ciphers: Only strong PCI-compliant ciphers
Additional certificate files: /etc/webmin/letsencrypt-ca.pem

However, if I go to that tab and change nothing, just accept the settings there, I get the error
Failed to save SSL options : The SSL private key file /etc/webmin/letsencrypt-key.pem does not exist or does not contain a PEM format key

The file definitely exists, so I guess it’s not in the PEM format. So it still says the cert is self-signed and not trusted when I go there in my browser.

When I generate the script on the Let’s Encrypt tab, I have it set to :

Hostnames for certificate: hostname.example.com
Website root directory for validation file: /home/hostname/public_html
Copy new key and certificate to Webmin?: Yes

And when I do that, it does in fact put the certificate files in /etc/webmin, but no matter what I get the error when I try to save my settings, saying it’s not in PM format.

I would love to know what I’m doing wrong!

ergophobe · October 20, 2017, 5:19am

By the way, this is the private key in the file named /etc/webmin/letsencrypt-key.pem which is copied there when I request a key on the Let’s Encrypt tab.

I tried an online PEM validator and it rejects it too.

ergophobe · October 20, 2017, 5:35am

I think I solved it. When I generated the cert that is actually working for hostname.example.com, LE puts a few files in /home/hostname

One of them is ssl.combined

When I changed the SSL settings to point to that file, and saved, I once again got the error message saying the file did not exist or was not PEM format (even though a PEM validator said it was). But when the browser refreshed, the security warning was gone. I opened in a new browser, and it also worked with no warning.

But then when I look at the Current Certificate tab, it looks correct
Domain name hostname.example.com Additional domains hostname.example.com Issuer name Let’s Encrypt Authority X3 Issuer organization Let’s Encrypt Valid until Jan 18 03:54:45 2018 GMT Certificate type Signed by CA