{"id":3386,"date":"2019-01-16T08:38:29","date_gmt":"2019-01-16T03:08:29","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=3386"},"modified":"2026-10-09T11:08:55","modified_gmt":"2026-10-09T05:38:55","slug":"how-to-force-webmail-to-use-ssl-in-vestacp","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/how-to-force-webmail-to-use-ssl-in-vestacp\/","title":{"rendered":"How to Force Webmail to Use SSL in VestaCP"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Post Date:<\/strong> January 16, 2019<br><strong>Last Updated:<\/strong> October 09, 2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Securing webmail with SSL\/TLS helps protect the connection between users and the webmail application. When webmail is accessed over HTTP, the connection is not encrypted. By redirecting HTTP requests to HTTPS, you can ensure that users access webmail through a secure connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we will explain <a href=\"https:\/\/vestacp.com\/docs\/how-to-force-https-ssl-on-a-domain\" data-type=\"link\" data-id=\"https:\/\/vestacp.com\/docs\/how-to-force-https-ssl-on-a-domain\" target=\"_blank\" rel=\"noopener\">how to force Webmail to use HTTPS in VestaCP<\/a> by updating the Roundcube <code>.htaccess<\/code> file with Apache rewrite rules and verifying the redirect using cURL.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/01\/image-2.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"621\" height=\"351\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/01\/image-2.png\" alt=\"\" class=\"wp-image-12195\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/01\/image-2.png 621w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/01\/image-2-300x170.png 300w\" sizes=\"(max-width: 621px) 100vw, 621px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before proceeding, make sure you have:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A server running VestaCP.<\/li>\n\n\n\n<li>Webmail installed and accessible through Roundcube.<\/li>\n\n\n\n<li>A valid SSL certificate configured for your webmail hostname.<\/li>\n\n\n\n<li>SSH access or permission to edit the relevant server files.<\/li>\n\n\n\n<li>Apache <code>mod_rewrite<\/code> enabled.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Locate the Roundcube Configuration File<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To force webmail to use HTTPS, locate the <code>.htaccess<\/code> file in the Roundcube installation directory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The original tutorial identifies this path:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/var\/lib\/roundcube\/.htaccess<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the file using a text editor:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo nano \/var\/lib\/roundcube\/.htaccess<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Before making changes, create a backup of the existing file:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo cp \/var\/lib\/roundcube\/.htaccess \\\n\/var\/lib\/roundcube\/.htaccess.bak<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This backup allows you to restore the previous configuration if required.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Add the HTTPS Rewrite Rules<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following rules to the <code>.htaccess<\/code> file, under the existing <code>RewriteRule<\/code> section or near the beginning of the file if no conflicting rules exist.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Force SSL usage\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule (.*) https:\/\/%{HTTP_HOST}%{REQUEST_URI} [R=301,L]<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Explanation<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>RewriteEngine On<\/code> enables Apache URL rewriting.<\/li>\n\n\n\n<li><code>RewriteCond %{HTTPS} off<\/code> checks whether the request is using an unencrypted HTTP connection.<\/li>\n\n\n\n<li><code>RewriteRule<\/code> redirects the request to HTTPS while preserving the hostname and requested URL path.<\/li>\n\n\n\n<li><code>[R=301,L]<\/code> issues a permanent redirect and stops processing further rewrite rules.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Apache documents this approach for redirecting HTTP requests to HTTPS when using <code>.htaccess<\/code>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/httpd.apache.org&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Apache HTTP Server Version 2.4<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Important: Make sure the SSL certificate is valid for the hostname used in the redirect. If the webmail service is accessed through a specific hostname, such as <code>webmail.example.com<\/code>, verify that the certificate covers that hostname.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Verify the HTTPS Redirect Using cURL<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After saving the changes, verify that HTTP requests are redirected to HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command, replacing <code>webmail.example.com<\/code> with your actual webmail hostname:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">curl -I http:\/\/webmail.example.com\/webmail\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The response should contain a redirect status, such as:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">HTTP\/1.1 301 Moved Permanently\nLocation: https:\/\/webmail.example.com\/webmail\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact status and response headers may vary depending on the server configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To follow the redirect and inspect the final response, use:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">curl -IL http:\/\/webmail.example.com\/webmail\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check that the final URL uses HTTPS and that the request reaches the expected webmail page.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the redirect does not work, confirm that Apache rewrite rules are enabled and that the <code>.htaccess<\/code> file is being read by the web server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we covered how to force Webmail to use SSL\/HTTPS in VestaCP by editing the Roundcube <code>.htaccess<\/code> file, adding Apache rewrite rules, and verifying the redirect using cURL.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This helps ensure that users accessing webmail over HTTP are redirected to the secure HTTPS URL. Remember to verify the SSL certificate and test the redirect before relying on the configuration in production.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">1. Why should Webmail use HTTPS?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS encrypts communication between the browser and the webmail server, helping protect login credentials and email-related information in transit.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2. Which file is used in this tutorial?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The original tutorial uses <code>\/var\/lib\/roundcube\/.htaccess<\/code> to configure the redirect.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">3. How can I check whether the redirect works?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Use <code>curl -I<\/code> with the HTTP webmail URL and check the response headers for a redirect to the HTTPS URL.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">4. Does the redirect work without an SSL certificate?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">No. The destination HTTPS hostname needs a valid, correctly configured SSL certificate for secure access without certificate warnings.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/laravel-installation-vestacp-account\/\">Laravel Installation in VestaCP Account<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/webmail-subdomains-mapping-vestcp\/\">Webmail Subdomains Mapping in VestaCP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/add-webmail-alias-vestacp-panel-ubuntu-16-04\/\">Add Webmail Alias in VestaCP Panel \u2013 Ubuntu 16.04<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Talk to Our Experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Need help configuring SSL certificates, securing webmail, or managing your hosting server? Our experts can help you find the right solution for your business.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Get in touch with us: <a href=\"https:\/\/pheonixsolutions.com\/contact\">Contact our team<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Post Date: January 16, 2019Last Updated: October 09, 2026 Introduction Securing webmail with SSL\/TLS helps protect the connection between users [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1024],"tags":[216,277,344,188],"class_list":["post-3386","post","type-post","status-publish","format-standard","hentry","category-security","tag-roundcube","tag-ssl","tag-vestacp","tag-webmail","psol-cat-security"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-SC","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=3386"}],"version-history":[{"count":3,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3386\/revisions"}],"predecessor-version":[{"id":12205,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3386\/revisions\/12205"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=3386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=3386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=3386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}