Setting up DA with an SSL certificate

Enter Your Query:
Use '%' for wildcards and quotes for "exact phrases"

Top Level » Install Issues
Top Level » General Usage
Top Level » SSL

Setting up DA with an SSL certificateLast Modified: May 7, 2016, 2:58 am
You can switch DirectAdmin to use SSL instead of plain text. -> https instead of http on port 2222.
Note that this is for the DirectAdmin connection on port 2222, *not* for apache.
If you're tryting to setup a certificate for your domain through apache, use this guide.

Creating a Self-Signed Certificate

If you do not have your own certificates, you'll need to create your own:

/usr/bin/openssl req -x509 -sha256 -newkey rsa:4096 -keyout /usr/local/directadmin/conf/cakey.pem -out /usr/local/directadmin/conf/cacert.pem -days 9000 -nodes

chown diradmin:diradmin /usr/local/directadmin/conf/cakey.pem
chmod 400 /usr/local/directadmin/conf/cakey.pem

Installing a Purchased Certificate

If you already have your own certificate and key, then paste them into the following files:

certificate:  /usr/local/directadmin/conf/cacert.pem
key: /usr/local/directadmin/conf/cakey.pem

Edit the /usr/local/directadmin/conf/directadmin.conf and set SSL=1  (default is 0).  This tells DA to load the certificate and key and to use an SSL connection.
Ensure your directadmin.conf has the values set:


but can be changed as needed.

DirectAdmin needs to be restarted after any changes to the directadmin.conf.

If you also have a CA Root Certificate, this can be specified by adding:


into the /usr/local/directadmin/conf/directadmin.conf file (won't exist by default) and by pasting the contents of the caroot cert into that file.

Using the free "Let's Encrypt" tool to secure 2222

As of DA 1.50.0, we've added a new feature that allows you to make use of LetsEncrypt, a tool offering free basic SSL certificates.
We've written the script in such a manner that you can also setup SSL for your hostname and all services in one simple command for your hostname:

cd /usr/local/directadmin/scripts
./ request 4096

which will also install the new cert/key/ca files in all respective global places for apache, dovecot, exim, ftp, and DirectAdmin.
NOTE The hostname value, eg: must match the "servername" value set in the directadmin.conf, or it will not be in hostname mode, but User domain mode instead.

You must then turn on SSL in DA and tell DA to use the carootcert, as well as force the hostname for SSL:

cd /usr/local/directadmin/conf
perl -pi -e 's/SSL=0/SSL=1/' directadmin.conf
echo "carootcert=/usr/local/directadmin/conf/carootcert.pem" >> directadmin.conf
echo "" >> directadmin.conf
echo "" >> directadmin.conf
/etc/init.d/directadmin restart

Note, as of 1.30.2, you can set the value of the SSL redirect should a User connect to an https connection with plaintext http.

For 1.33.0, you can force DA to redirect to a specific hostname if you wish the host to match the cert installed:
However, if they connect to https on a different host, they'll first get the ssl warning (since ssl is established before the host is passed), then they'll be redirected to the correct host, where the error would not appear (assuming you've got a valid cert setup)

As of 1.33.3, you can enable a ssl cipher to force SSLv3, and disable SSLv2:

DA 1.48.4 will support HTTP Strict Transport Security (HSTS):
But we recommend you enable both the force_hostname as well as the ssl_redirect_host with a non-apache-used host, like, and not, as HSTS doesn't respect only port 2222, it would bleed over to apache, changing (80) connections to use (443), even though the header was only set on port 2222.
Related Helpfiles
How to manually create a certificate request (CSR)

2003 JBMC Software, Suite 173  3-11 Bellerose Drive, St Albert, AB  T8N 1P7  Canada.  Mon-Fri 9AM-5PM MST