So far you will have received warning on the SSL certificates you use for Postfix, Dovecot and the RoundCube email web interface. SSL/TLS is a great way to automatically encrypt the passwords between the email user and your mail server. So you want to have proper certificates. There are three ways you can handle your certificate:
Either: Leave it like it is
The users will receive a warning that the certificate is invalid and likely does not even match the name of the mail server.
- Advantage: lazy, no costs
- Disadvantage: some email clients will refuse the certficate because not even the server name matches
- Conclusion: only do this if you don't care
Or: Create a self-signed certificate
This will at least give your users a certificate with with the proper name of the mail server.
- Advantage: little work, no costs
- Disadvantage: you train your users to accept any certificate (even a malicious one)
- Conclusion: do this if you have a very small group of users who you can tell about the certificate
Creating SSL certificates can be tricky due to the syntax of the "openssl" command line tool that often reminds me of text adventures.
Dovecot
Here comes the command to create a Dovecot certificate:
openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.pem
What you enter in the fields is entirely your choice. The only notable exception is the "Common Name" which has to be exactly the name of your server in the way that users will access it. So if you tell your users to access your mail server at "mail.example.org" then this has to be entered here. This certificate will be valid for 10 years (10 times 365 days).
Do not forget to set the permissions on the private key so that no unauthorized people can read it:
chmod o= /etc/ssl/private/dovecot.pem
And you will have to restart Dovecot to make it read your new certificate:
/etc/init.d/dovecot restart
Postfix
To create a certificate to be used by Postfix use:
openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/postfix.pem -keyout /etc/ssl/private/postfix.pem
Do not forget to set the permissions on the private key so that no unauthorized people can read it:
chmod o= /etc/ssl/private/postfix.pem
You will have to tell Postfix where to find your certificate and private key because by default it will look for a dummy certificate file called "ssl-cert-snakeoil":
postconf -e smtpd_tls_cert_file=/etc/ssl/certs/postfix.pem
postconf -e smtpd_tls_key_file=/etc/ssl/private/postfix.pem
Or: Use a free certification authority
- Advantage: a little work, no costs
- Disadvantage: these certification authorities are not included in all email clients
- Conclusion: if you don't want to spend money then this is your best chance
There are barely any free services like that. I have had good experience with StartSSL although their web site is sometimes confusing. Once you have created a key file and certificate then use these files as shown in the previous section about creating self-signed certificates.
Or: Buy an SSL certificate
- Advantage: certificate will be accepted automatically by the user's email program
- Disadvantage: you throw a lot of money at the certification mafia that doesn't deserve it
- Conclusion: do this if you will run a professional public mail server
Honestly I dislike any commercial certification authority I have been in contact with. So choose the lesser evil yourself.
36 Comments
With 'Create a self-signed certificate'
Submitted by Anonymous (not verified) on
I get these messages:
dovecot: imap-login: Disconnected (no auth attempts): rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
How to solve this thing?
I'm having the exactly same
Submitted by Guest (not verified) on
I'm having the exactly same problem.
possible solution for thunderbird users
Submitted by shahaya (not verified) on
Hi,
had the same error after trying to connect with a recent thunderbird version. It simply didn't work, even if you just tried to create a new account in thunderbird.
I solved this error by configuring tb correctly (!). Just import your created certificate into TB.
Thunderbird: Tools-->Options-->Advanced-->View Certificates-->Servers-->Add Exception
Location: yourserver:143 or yourserver:993 (depending on your config)
After that i suddenly had no problems logging into my mailserver, the error message disappeared:-)
Hope this info helps all the people, who might stumble over it.
Could you clarify please?
Submitted by Anonymous (not verified) on
If the server host name is "mail" and the domain is "example.org", for the puposes of people accessing the server and for creating a certificate, does the fully qualified domain name become;
mail.example.org
or does it simply remain;
example.org
That's a part that I'm having a problem getting my head around.
Some certificates I've looked at when trying to come up with an answer even have (for example);
www.example.org
Is it any wonder I find it confusing?
More on this.
Submitted by Anonymous (not verified) on
Investigating further, is it true to say, the fully qualified domain name is what is stated in the postfix main.cf file, under "myhostname=" ?
fqdn
Submitted by Anonymous (not verified) on
For the purposes of the certificate, the fqdn is the name that you will access the server with. So it's the one that you'll put in your mail client.
Thank you.
Submitted by Anonymous (not verified) on
Thank you very much.
A little more research has shown:
hostname --fqdn
at the command line, reveals what the machine believes it is - or more accurately, what it's been configured as.
So that's what I've gone with and it seems to work OK.
Many thanks for your reply.
Even more important than
Submitted by Christoph Haas on
Even more important than "hostname --fqdn" is what server name you give out to your customers/clients. Because the name they use in their email client's settings is what is checked against the certificate's common name.
Ah! the penny's dropped!
Submitted by Anonymous (not verified) on
Thank you so much Christoph.
Now I see the relationship and importance of the certificate name.
Cert permissions.
Submitted by Anonymous (not verified) on
I would be grateful if someone could clarify just how the four certificates should exist regarding ownership and permissions.
The mail server operates just fine but I've been struggling for the past month or so with an error that says my emails are unsigned, in spite of following this tutorial (I think) correctly.
It seems I may have narrowed the problem down to certificate permissions, as it seems to me, if Postfix and Dovecot cannot read the certs, they can't use them.
All these certificates were gererated by "root" and appear as follows;
/etc/ssl/certs -rw-r--r-- root dovecot dovecot.pem
/etc/ssl/certs -rw-r--r-- root root postfix.pem
The above don't seem to be a problem, as "others" can read them and they are meant to be public.
The private certificates are as follows:
/etc/ssl/private -rw------ root dovecot dovecot.pem
/etc/ssl/private -rw-r---- root root postfix.pem
These appear to me to be a potentail road block. dovecot.pem is owned by root and has rw permissions, but has no group read allocation and does Dovecot need to access it?
postfix.pem is owned by root and the group is root, with no access for Postfix. Is that correct?
Any light on this subject would be greatly appreciated, as I may be reading something into this that doesn't exist and have to look elsewhere to solve my problem.
Free SSL certificates at cacert.org
Submitted by Anonymous (not verified) on
Free SSL certificates at cacert.org
Thanks.
Submitted by Anonymous (not verified) on
Thanks for your post.
In fact, just today, I've solved the problem. It was due to somehow the certifictes becoming corrupted. I found it quite by chance, as I've just rebuilt my main server and installed everything again from scratch and hey presto, it all works.
As all the configuration files were transferred from my standby server, the only thing that was generated new, were the certificates, so it has to be them.
Thanks for taking the time to respond though. It was an on-going problem, that at one stage I was wondering if I was ever going to solve!
get matching error
Submitted by Anonymous (not verified) on
Get "WARNING: Server hostname does not match certificate" when using mutt -f imap://john@example.org@localhost Using mail.example.org. Anyone else have this problem?
You are connecting using
Submitted by Christoph Haas on
You are connecting using imap:// and not imaps:// so you don't talk SSL anyway. Strange. Otherwise it's pretty obvious that the certificate does not match because its common name is "mail.example.org" in your example but you are connecting to the server using "localhost". The certificate warning will always appear if the common name of the certificate does not match the host name you are connecting to.
contd
Submitted by Anonymous (not verified) on
Forgot to mention, the certificate is self signed. Not sure is that makes a difference.
certificate match
Submitted by Anonymous (not verified) on
Thanks Chris. Your comments fixed the problem. I used sudo mutt -f imaps://john@example.com@mail.example.com and it worked.
P.S. I really like your tutorial (I had even donated a bit earlier.) Thanks for all the time and effort you put in.
some useful tips
Submitted by Anonymous (not verified) on
Hi Christoph,
After spending some time on this, I think I have come up with some useful tips.
1) Appears one can buy a cheap < $9 USD SSL Comodo (accepted by almost all browsers) through reseller namecheap.com
2) Most SSL certs now give intermediate certs for security purposes. Just cat (e.g. combine) the certs together yours top, intermediate, root bottom
3) Christoph tried to get your solution to work with an email client. But many ISPs block port 25 -so did not work. Had to modify your tutorial to uncomment just ONE line in /etc/postfix/master.cf. Uncomment the words "submission inet n - - - - smtpd" only. Now use port 587 instead of port 25.
Christoph, I hope I did not mess anything up with my small change in step #3? Thanks for your help.
key for a virtual host
Submitted by Anonymous (not verified) on
So, I have a machine name. I have my FQDN for the main server and I virtually host several websites and emails.
Which info goes into the keys? It looks like there is only one set of keys for the server, so do the different domains all have to use the same keys and therefor the same SMTP setting in clients? For example
smtp.myFQDN.org
as opposed to
smtp.ThierVirtualDomain1.org
smtp.MyVirtualDomain2.org
etc.
port 465 instead of 25
Submitted by Anonymous (not verified) on
I uncomment (remove #) in /etc/postfix/master.cf the line smtps inet n - - - - smtpd and comment (put #) the line smtp inet n - - - - smtpd.
Now, I can send email with port 465 instead port 25 that is blocked by many ISPs.
But, I can send mails whit thunderbird, mail on Ipad but not whit outlook express ... why :-(
If I remain on port 25 (with ssl), everything works.
Could not login to mail server
Submitted by Anonymous (not verified) on
Hi,
Today I installed postfix, dovecot in my linode server.
I created the ssl certificates as per your instructions.
But I could not seem to login to my mail server using thunderbird.
Thunderbird complains that the user name or password is invalid.
I could telnet to my mail server and mails are being received when I sent from gmail.
Please help me to resolve this.
Thanks in advance
Poomalairaj
what did you do?
Submitted by Anonymous (not verified) on
did you changed the dovecot ssl certs location?
what ssl method you have used on thunderbird?
i have just install a verry big mail server today and it's works like a charm on:
GENTOO kernel 64bit 3.2.1 with dovecot 2.1.1 and postfix 2.8.7.
both are running with tls.
Regards,
Eliezer
Password
Submitted by Anonymous (not verified) on
Your password is the one md5
Submitted by Anonymous (not verified) on
Blah, i made miktake while
Submitted by Anonymous (not verified) on
Blah, i made miktake while typink password - forgot that, numlock was off.
SASL still not working
Submitted by Anonymous (not verified) on
hi,
my sasl wil not working ... some mails from or to outside are rejected
i checked the all the files and found these looks like okay, but the mail.log means others
anyway, this is the partly log:
Apr 8 14:55:23 server1 postfix/smtpd[2096]: warning: when SASL type is "dovecot", SASL path "smtpd" should be a socket pathname
Apr 8 14:55:23 server1 postfix/smtpd[2096]: warning: cannot get RSA private key from file /etc/ssl/private/postfix.key: disabling TLS support
Apr 8 14:55:23 server1 postfix/smtpd[2096]: warning: TLS library problem: 2096:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:406:
Apr 8 14:55:23 server1 postfix/smtpd[2096]: connect from p579F1F6A.dip.t-dialin.net[87.159.31.106]
Apr 8 14:55:23 server1 postfix/smtpd[2096]: warning: SASL: Connect to smtpd failed: No such file or directory
Apr 8 14:55:23 server1 postfix/smtpd[2096]: fatal: no SASL authentication mechanisms
Apr 8 14:55:24 server1 postfix/master[1667]: warning: process /usr/lib/postfix/smtpd pid 2096 exit status 1
Apr 8 14:55:24 server1 postfix/master[1667]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling
the part of socket listen in
Submitted by Anonymous (not verified) on
the part of socket listen in dovecot.conf is:
No I found out
Submitted by Anonymous (not verified) on
No I found out following:
uncomment SSL in dovecot.conf
Submitted by no (not verified) on
Hello, i think taht you forget, after generate certs. you might uncomment SSL and paths in dovecot.conf
##
## SSL settings
##
# IP or host address where to listen in for SSL connections. Remember to also
# add imaps and/or pop3s to protocols setting. Defaults to same as "listen"
# setting if not specified.
#ssl_listen =
# SSL/TLS support: yes, no, required. </usr/share/doc/dovecot-common/wiki/SSL.txt>
#ssl = yes
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root.
#ssl_cert_file = /etc/ssl/certs/dovecot.pem
#ssl_key_file = /etc/ssl/private/dovecot.pem
Thanks
People can do this
Submitted by no (not verified) on
Hello. with this configuration, People can do this, how can i solve it?
telnet xxx.org 25
EHLO xxx.org
MAIL FROM: cristof@xxx.org
RCPT TO: cristof@xxx.org
DATA
jack
.
The mail sender can easily be
Submitted by Christoph Haas on
The mail sender can easily be faked. The only way to prevent that on a server level is using SPF and/or DKIM. On a personal level PGP or S/MIME is the answer.
no telnet
Submitted by no (not verified) on
Hello, i probe this config, and then, telnet reject anonymous when you are in RCPT TO:
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
SSL for multiple domain
Submitted by dacer (not verified) on
Hi, if I have mail for multiple domain (mail.domain1.com, mail.domain2.com, mail.domain3.com), cert common name is only for one of them, and then mail programs alert me about insecure certificate every time I run them. Can I get multiple cert?, or a cert for multiple domains?. I use "Create a self-signed certificate" option.
Thanks
RE: SSL for multiple domain
Submitted by jetole (not verified) on
Not really. You can get multiple certs but you would need to place them each on separate IP addresses since SSL is performed before other TCP communications are accepted so it really means that the server has to present a SSL certificate before it knows which host name you are trying to connect to. This is the same with HTTP / web servers. Basically a client connects to the port, requests the cert, the server gives it the cert and then the client can communicate fully and then say to the server oh I was actually looking for a cert for another host name but at that point it's already too late. Their are some new techniques being implemented and standardized, etc which allow for multiple host names in a single cert therefor allowing you to have one cert sent to the client and then the client can see within the cert all of the host names it represents. If the host name it is trying to connect to is within the cert then it accepts it as valid. The problem is this is still new and not used by enough web browsers yet to really be an acceptable solution for most people which leads me to believe that it is even less implemented in the mail clients if it is even implemented in any mail clients at all yet.
Useing one proper SSL Cert
Submitted by Alois (not verified) on
Hi Christoph!
You are useing two differnet SSL certs - one for Postfix and one for Dovecot.
Is there a special reason why not useing the same cert for both like
/etc/ssl/private/hostname.domain.tld.pem
/etc/ssl/certs/hostname.domain.tld.pem
Alois
Hi Alois. No, there is no
Submitted by Christoph Haas on
Hi Alois. No, there is no specific reason to do that. I should clarify that in the upcoming Wheezy tutorial. I have formerly been using different host names for SMTP, IMAP or POP3. But I'm not doing that myself anymore and don't see a reason to do that. So feel free to share the certificate.
Thanks!
Submitted by Alois (not verified) on
Thanks for your feedback, Christoph!
Great work, thx for the tut!
Jm2c
Btw: smtps and submission settings (master.cf) were also points of interest for the upcoming tutorial.