6

In Postfix, I have specified my private key, my certificate, and the certificate of my CA

smtpd_tls_CAfile     = /etc/ssl/cacert.pem
smtpd_tls_key_file   = /etc/ssl/server.key
smtpd_tls_cert_file  = /etc/ssl/server.pem

In dovecot, there are only options to specify my key and my cert:

ssl_cert = </etc/ssl/server.pem
ssl_key = </etc/ssl/server.key

How do I specify the certificate of my CA ?

Update:

The problem is, when I connect with client to my port 993, I get certificate error. Using openssl s_client -connect server:993 I get this error:

verify return:1
verify error:num=27:certificate not trusted
verify return:1
verify error:num=21:unable to verify the first certificate
verify return:1

I don't get this error when I connect to port 465 (Postfix):

openssl s_client -connect server:465
Improve this question
14

What you need is a chain certificate. You can create one like this:

cat /etc/ssl/server.pem /etc/ssl/cacert.pem > /etc/ssl/chain.pem

and then use the chain as the server certificate

ssl_cert = </etc/ssl/chain.pem
ssl_key = </etc/ssl/server.key

Now when you connect with openssl s_client, you should get no errors (provided everything else is set up correctly)

Improve this answer
  • 3
    If by any change someone using let's encrypt certificates gets here, the ssl_cert should be the file fullchain.pem created by default. ssl_key should be privkey.pem. – TCB13 Dec 4 '15 at 18:18
  • 3
    However for postfix, it should be: smtpd_tls_key_file = privkey.pem, smtpd_tls_cert_file = cert.pem, smtpd_tls_CAfile = chain.pem. – TCB13 Dec 4 '15 at 18:21
  • Hey @TCB13 did you the SSL certificates work with Gmail web client? Am failing to connect to my mail server through pop3s using Gmail webmail. It says "There was a problem connecting to server. Server returned error: "Connection timed out: There may be a problem with the settings you added. Please contact your other email provider to verify the correct server name and port."". Any tips? – David Okwii Jan 31 '16 at 12:04
3

In general the server offers to the requesting client the server certificate plus all intermediary certification authorities certificates so that the client can match the top certificate of the chain to one of his trusted (root) certificates. That is true for apache, dovecot and postfix. Dovecot doesn't seem to have a setting for the trust chain, so in this case the trust chain has to be merged with the server certificate and be pointed to by.

ssl_cert = </etc/ssl/server-plus-chain.pem

The order of the certificates is

  1. server cert
  2. intermediary certs

The last intermediary cert is issued by the trusted root cert the client has available.

Improve this answer
1

Certificate and key are needed if the application works as a SSL server, e.g. the certificate is the one presented to the client. A list of trusted CA is needed if the application works as an SSL client and thus needs to verify the certificate presented by the server.

While postfix works as both server (accepting mails) and client (delivering mail to another mail server) dovecot is only a server and thus does not need a list of trusted CAs.

Improve this answer
  • please see my update – Martin Vegter Jul 24 '14 at 19:42
  • The CA setting for postifx is only used if postfix delivers mail, which is not the case in your example. You should get a similar error with postfix too because s_client has not default for CApath and therefore verification should fail. It might help if you would post the whole output of s_client for both cases to see what's going on. – Steffen Ullrich Jul 24 '14 at 19:53
  • I don't think what you say is correct. Apache also has parameter for CA certificate SSLCACertificateFile. – Martin Vegter Jul 24 '14 at 20:11
  • 1
    From apaches documentation: "SSLCACertificateFile...These are used for Client Authentication". I.e. it is used if the client authorizes itself using a certificate. For this case you have a ssl_ca setting (and others) in dovecot too, see wiki2.dovecot.org/SSL/DovecotConfiguration "Client certificate verification/authentication". Postfix uses smtpd_tls_CAfile setting both to verify client certificates when accepting and server certificates when delivering mail. But there are no client certificates involved in your example use with s_client. – Steffen Ullrich Jul 24 '14 at 20:26
0

CA certificates if you have multiple files, it is possible to solve follows

ssl_verify_client_cert = yes
ssl_ca = </etc/ssl/myssl/startssl.pem 
ssl_ca = </etc/ssl/myssl/sub.class2.server.ca.pem
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.