Proper SSL certificates for Postfix and Dovecot

So far you will have received warning on the SSL certificates you use for Postfix, Dovecot and the RoundCube email web interface. SSL/TLS is a great way to automatically encrypt the passwords between the email user and your mail server. So you want to have proper certificates. There are three ways you can handle your certificate:

Either: Leave it like it is

The users will receive a warning that the certificate is invalid and likely does not even match the name of the mail server.

  • Advantage: lazy, no costs
  • Disadvantage: some email clients will refuse the certficate because not even the server name matches
  • Conclusion: only do this if you don't care

Or: Create a self-signed certificate

This will at least give your users a certificate with with the proper name of the mail server.

  • Advantage: little work, no costs
  • Disadvantage: you train your users to accept any certificate (even a malicious one)
  • Conclusion: do this if you have a very small group of users who you can tell about the certificate

Creating SSL certificates can be tricky due to the syntax of the "openssl" command line tool that often reminds me of text adventures.

Dovecot

Here comes the command to create a Dovecot certificate:

openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.pem

What you enter in the fields is entirely your choice. The only notable exception is the "Common Name" which has to be exactly the name of your server in the way that users will access it. So if you tell your users to access your mail server at "mail.example.org" then this has to be entered here. This certificate will be valid for 10 years (10 times 365 days).

Do not forget to set the permissions on the private key so that no unauthorized people can read it:

chmod o= /etc/ssl/private/dovecot.pem

And you will have to restart Dovecot to make it read your new certificate:

/etc/init.d/dovecot restart

Postfix

To create a certificate to be used by Postfix use:

openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/postfix.pem -keyout /etc/ssl/private/postfix.pem

Do not forget to set the permissions on the private key so that no unauthorized people can read it:

chmod o= /etc/ssl/private/postfix.pem

You will have to tell Postfix where to find your certificate and private key because by default it will look for a dummy certificate file called "ssl-cert-snakeoil":

postconf -e smtpd_tls_cert_file=/etc/ssl/certs/postfix.pem
postconf -e smtpd_tls_key_file=/etc/ssl/private/postfix.pem

Or: Use a free certification authority

  • Advantage: a little work, no costs
  • Disadvantage: these certification authorities are not included in all email clients
  • Conclusion: if you don't want to spend money then this is your best chance

There are barely any free services like that. I have had good experience with StartSSL although their web site is sometimes confusing. Once you have created a key file and certificate then use these files as shown in the previous section about creating self-signed certificates.

Or: Buy an SSL certificate

  • Advantage: certificate will be accepted automatically by the user's email program
  • Disadvantage: you throw a lot of money at the certification mafia that doesn't deserve it
  • Conclusion: do this if you will run a professional public mail server

Honestly I dislike any commercial certification authority I have been in contact with. So choose the lesser evil yourself.

36 Comments

With 'Create a self-signed certificate'

I get these messages:

dovecot: imap-login: Disconnected (no auth attempts): rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
 

How to solve this thing?

possible solution for thunderbird users

Hi,
had the same error after trying to connect with a recent thunderbird version. It simply didn't work, even if you just tried to create a new account in thunderbird.

I solved this error by configuring tb correctly (!). Just import your created certificate into TB.
Thunderbird: Tools-->Options-->Advanced-->View Certificates-->Servers-->Add Exception
Location: yourserver:143 or yourserver:993 (depending on your config)

After that i suddenly had no problems logging into my mailserver, the error message disappeared:-)
Hope this info helps all the people, who might stumble over it.

Could you clarify please?

If the server host name is "mail" and the domain is "example.org", for the puposes of people accessing the server and for creating a certificate, does the fully qualified domain name become;

mail.example.org

or does it simply remain;

example.org

That's a part that I'm having a problem getting my head around.

Some certificates I've looked at when trying to come up with an answer even have (for example);

www.example.org

Is it any wonder I find it confusing?

More on this.

Investigating further, is it true to say, the fully qualified domain name is what is stated in the postfix  main.cf file, under "myhostname=" ?

fqdn

For the purposes of the certificate, the fqdn is the name that you will access the server with. So it's the one that you'll put in your mail client.

Thank you.

Thank you very much.

A little more research has shown:

hostname --fqdn

at the command line, reveals what the machine believes it is - or more accurately, what it's been configured as.

So that's what I've gone with and it seems to work OK.

Many thanks for your reply.

Cert permissions.

I would be grateful if someone could clarify just how the four certificates should exist regarding ownership and permissions.

The mail server operates just fine but I've been struggling for the past month or so with an error that says my emails are unsigned, in spite of following this tutorial (I think) correctly.

It seems I may have narrowed the problem down to certificate permissions, as it seems to me, if Postfix and Dovecot cannot read the certs, they can't use them.

All these certificates were gererated by "root" and appear as follows;

/etc/ssl/certs -rw-r--r-- root dovecot dovecot.pem

/etc/ssl/certs -rw-r--r-- root root       postfix.pem

The above don't seem to be a problem, as "others" can read them and they are meant to be public.

The private certificates are as follows:

/etc/ssl/private -rw------ root dovecot dovecot.pem

/etc/ssl/private -rw-r---- root root       postfix.pem

These appear to me to be a potentail road block. dovecot.pem is owned by root and has rw permissions, but has  no group read allocation and does Dovecot need to access it?

postfix.pem is owned by root and the group is root, with no access for Postfix. Is that correct?

Any light on this subject would be greatly appreciated, as I may be reading something into this that doesn't exist and have to look elsewhere to solve my problem.

Thanks.

Thanks for your post.

In fact, just today, I've solved the problem. It was due to somehow the certifictes becoming corrupted. I found it quite by chance, as I've just rebuilt my main server and installed everything again from scratch and hey presto, it all works.

As all the configuration files were transferred from my standby server, the only thing that was generated new, were the certificates, so it has to be them.

Thanks for taking the time to respond though. It was an on-going problem, that at one stage I was wondering if I was ever going to solve!

get matching error

Get "WARNING: Server hostname does not match certificate" when using mutt -f imap://john@example.org@localhost   Using mail.example.org.  Anyone else have this problem?

contd

Forgot to mention, the certificate is self signed.  Not sure is that makes a difference.

certificate match

Thanks Chris.  Your comments fixed the problem.  I used sudo mutt -f imaps://john@example.com@mail.example.com and it worked.


P.S. I really like your tutorial (I had even donated a bit earlier.) Thanks for all the time and effort you put in.

some useful tips

Hi Christoph,

After spending some time on this, I think I have come up with some useful tips. 

1) Appears one can buy a cheap < $9 USD SSL Comodo (accepted by almost all browsers) through reseller namecheap.com

2) Most SSL certs now give intermediate certs for security purposes.  Just cat (e.g. combine) the certs together yours top, intermediate, root bottom

3) Christoph tried to get your solution to work with an email client.  But many ISPs block port 25 -so did not work.  Had to modify your tutorial to uncomment just ONE line in /etc/postfix/master.cf.  Uncomment the words "submission inet n       -       -       -       -       smtpd" only.  Now use port 587 instead of port 25. 

Christoph, I hope I did not mess anything up with my small change in step #3?  Thanks for your help.

 

key for a virtual host

So, I have a machine name.  I have my FQDN for the main server and I virtually host several websites and emails.

Which info goes into the keys?  It looks like there is only one set of keys for the server, so do the different domains all have to use the same keys and therefor the same SMTP setting in clients?  For example

smtp.myFQDN.org

as opposed to

smtp.ThierVirtualDomain1.org

smtp.MyVirtualDomain2.org

etc.

 

port 465 instead of 25

I uncomment (remove #)  in /etc/postfix/master.cf the line smtps  inet n - - - - smtpd and comment (put #) the line smtp inet n - - - - smtpd.

Now, I can send email with port 465 instead port 25 that is blocked by many ISPs.

But, I can send mails whit thunderbird, mail on Ipad but not whit outlook express ... why :-(

If I remain on port 25 (with ssl), everything works.

Could not login to mail server

Hi,

Today I installed postfix, dovecot in my linode server.

I created the ssl certificates as per your instructions.

But I could not seem to login to my mail server using thunderbird.

Thunderbird complains that the user name or password is invalid.

I could telnet to my mail server and mails are being received when I sent from gmail.

Please help me to resolve this.

 

Thanks in advance

Poomalairaj

what did you do?

did you changed the dovecot ssl certs location?

what ssl method you have used on thunderbird?

i have just install a verry big mail server today and it's works like a charm on:

GENTOO kernel 64bit 3.2.1 with dovecot 2.1.1 and postfix 2.8.7.

both are running with tls.

 

Regards,

Eliezer

Password

Hi, 
I followed your guide, but when i try to mutt -f imap://karol@xxx.pl@localhost it asks me for password
i tried to use my root password, user password, blank password, few others passwords (even mysql :D),
but it don't want to work.
Where is my password?
Thanks, Karol
 

SASL still not working

hi,

my sasl wil not working ... some mails from or to outside are rejected

i checked the all the files and found these looks like okay, but the mail.log means others

anyway, this is the partly log:

Apr  8 14:55:23 server1 postfix/smtpd[2096]: warning: when SASL type is "dovecot", SASL path "smtpd" should be a socket pathname
Apr  8 14:55:23 server1 postfix/smtpd[2096]: warning: cannot get RSA private key from file /etc/ssl/private/postfix.key: disabling TLS support
Apr  8 14:55:23 server1 postfix/smtpd[2096]: warning: TLS library problem: 2096:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:406:
Apr  8 14:55:23 server1 postfix/smtpd[2096]: connect from p579F1F6A.dip.t-dialin.net[87.159.31.106]
Apr  8 14:55:23 server1 postfix/smtpd[2096]: warning: SASL: Connect to smtpd failed: No such file or directory
Apr  8 14:55:23 server1 postfix/smtpd[2096]: fatal: no SASL authentication mechanisms
Apr  8 14:55:24 server1 postfix/master[1667]: warning: process /usr/lib/postfix/smtpd pid 2096 exit status 1
Apr  8 14:55:24 server1 postfix/master[1667]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling

 
in this case, its not possible for me to find the solution
do anyone have an idea?
 
best regards

the part of socket listen in

the part of socket listen in dovecot.conf is:

  socket listen {
    master {
      # Master socket provides access to userdb information. It's typically
      # used to give Dovecot's local delivery agent access to userdb so it
      # can find mailbox locations.
      path = /var/run/dovecot/auth-master
      mode = 0600
      # Default user/group is the one who started dovecot-auth (root)
      user = vmail
      #group = 
    }
    client {
      # The client socket is generally safe to export to everyone. Typical use
      # is to export it to your SMTP server so it can do SMTP AUTH lookups
      # using it.
      path = /var/run/dovecot/auth-client
      mode = 0660
      user = postfix
      group = postfix
    }
  }
 
...

No I found out

No I found out following:

 

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/postfix.pem
smtpd_tls_key_file=/etc/ssl/private/postfix.key
#smtpd_use_tls=yes
smtpd_use_tls=no
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
 
As You can see ... I only changed smtpd_use_tls= from yes to no
Thereafter it looks like working fine ... mails are coming in and going out .. but:
 
Is this a point of unsecureness? Anyway, what I know at this time is, that the problem is within TLS and all other configurations seems to be good!
 
Anybody has an idea what is wrong with TLS???
 
regards

uncomment SSL in dovecot.conf

Hello, i think taht you forget, after generate certs. you might uncomment SSL and paths in dovecot.conf

##
## SSL settings
##

# IP or host address where to listen in for SSL connections. Remember to also
# add imaps and/or pop3s to protocols setting. Defaults to same as "listen"
# setting if not specified.
#ssl_listen =

# SSL/TLS support: yes, no, required. </usr/share/doc/dovecot-common/wiki/SSL.txt>
#ssl = yes

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root.
#ssl_cert_file = /etc/ssl/certs/dovecot.pem
#ssl_key_file = /etc/ssl/private/dovecot.pem

Thanks

People can do this

Hello. with this configuration, People can do this, how can i solve it?
telnet xxx.org 25
EHLO xxx.org
MAIL FROM: cristof@xxx.org
RCPT TO: cristof@xxx.org
DATA
jack
.

no telnet

Hello, i probe this config, and then, telnet reject anonymous when you are in RCPT TO:

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

SSL for multiple domain

Hi, if I have mail for multiple domain (mail.domain1.com, mail.domain2.com, mail.domain3.com), cert common name is only for one of them, and then mail programs alert me about insecure certificate every time I run them. Can I get multiple cert?, or a cert for multiple domains?. I use "Create a self-signed certificate" option.

Thanks

RE: SSL for multiple domain

Not really. You can get multiple certs but you would need to place them each on separate IP addresses since SSL is performed before other TCP communications are accepted so it really means that the server has to present a SSL certificate before it knows which host name you are trying to connect to. This is the same with HTTP / web servers. Basically a client connects to the port, requests the cert, the server gives it the cert and then the client can communicate fully and then say to the server oh I was actually looking for a cert for another host name but at that point it's already too late. Their are some new techniques being implemented and standardized, etc which allow for multiple host names in a single cert therefor allowing you to have one cert sent to the client and then the client can see within the cert all of the host names it represents. If the host name it is trying to connect to is within the cert then it accepts it as valid. The problem is this is still new and not used by enough web browsers yet to really be an acceptable solution for most people which leads me to believe that it is even less implemented in the mail clients if it is even implemented in any mail clients at all yet.

Useing one proper SSL Cert

Hi Christoph!
You are useing two differnet SSL certs - one for Postfix and one for Dovecot.
Is there a special reason why not useing the same cert for both like

/etc/ssl/private/hostname.domain.tld.pem
/etc/ssl/certs/hostname.domain.tld.pem

Alois

Thanks!

Thanks for your feedback, Christoph!
Great work, thx for the tut!
Jm2c

Btw: smtps and submission settings (master.cf) were also points of interest for the upcoming tutorial.