Certificate: Difference between revisions

From QmailToaster
Jump to navigation Jump to search
(Created page with "<u>'''Security Certificate'''</u> To configure a SSL certificate for TLS and/or SSL over SMTP: 1) Create a private key using the triple des encryption standard (recommended): # openssl genrsa -des3 -out servercert.key.enc 1024 2) Remove the pass phrase from the private key: # openssl rsa -in servercert.key.enc -out servercert.key 3) Generate Certificate Request # openssl req -new -key servercert.key -out servercert.csr 4) Go to [http://www.discountwebcerts.com/i...")
 
No edit summary
(52 intermediate revisions by the same user not shown)
Line 1: Line 1:
<u>'''Security Certificate'''</u>
<u>'''Security Certificate'''</u>


To configure a SSL certificate for TLS and/or SSL over SMTP:
# Abstract: Create Certificate
#: Generate key
#: Generate signing request
#: Sign the key
#: Create server certificate
#: Set permission
#: Set owner
#: Copy into place
#: Restart services
#: Implementation
## Self-Signed Certificate
##: <nowiki>#</nowiki> openssl genrsa -out x.key 2048
##: <nowiki>#</nowiki> openssl req -new -key x.key -out x.csr
##: <nowiki>#</nowiki> openssl x509 -req -days 3650 -in x.csr -signkey x.key -out x.crt
##: <nowiki>#</nowiki> cat x.crt x.key > servercert.pem
##: <nowiki>#</nowiki> chmod 644 servercert.pem
##: <nowiki>#</nowiki> chown root<nowiki>:</nowiki>qmail servercert.pem
##: <nowiki>#</nowiki> cp -p servercert.pem /var/qmail/control
## Let's Encrypt (Assumes working web server)
##: <nowiki>#</nowiki> yum install python-certbot-apache
##: <nowiki>#</nowiki> certbot -apache -d mydomain.com -d mail.mydomain.com
##; Apache
##: SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
##: SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
##: SSLCertificateChainFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
##; Dovecot
##: ssl_cert = </etc/letsencrypt/live/mydomain.com/fullchain.pem
##: ssl_key = </etc/letsencrypt/live/mydomain.com/privkey.pem
##; Qmail
##: <nowiki>#</nowiki> cp -p /var/qmail/control/servercert.pem /var/qmail/control/servercert.pem.bak
##: '''EL 7/8'''
##: <nowiki>#</nowiki> cat /etc/letsencrypt/live/mydomain.com/privkey.pem /etc/letsencrypt/live/mydomain.com/fullchain.pem > /var/qmail/control/servercert.pem
##: '''EL 9'''
##: <nowiki>#</nowiki> cat /etc/letsencrypt/live/mydomain.com/fullchain.pem /etc/letsencrypt/live/mydomain.com/privkey.pem > /var/qmail/control/servercert.pem
##; Cron auto renew (script below)
##: 0 0 * * * /opt/certbot/certbot renew
## Application: Godaddy Signed Certificate
##:<nowiki>#</nowiki> openssl genrsa -out x.key 2048
##:<nowiki>#</nowiki> openssl req -new -key x.key -out x.csr
##; Submit signing request (x.csr) to Godaddy; Later download signed key (crt and crt bundle)
##:<nowiki>#</nowiki> cat x.key 7531fdb8504afe19.crt gd_bundle-g2-g1.crt > servercert.pem
##:<nowiki>#</nowiki> chmod 644 servercert.pem
##:<nowiki>#</nowiki> chown root<nowiki>:</nowiki>qmail servercert.pem
##:<nowiki>#</nowiki> cp -p servercert.pem /var/qmail/control
# Restart Qmail and Dovecot
#:<nowiki>#</nowiki> qmailctl stop && sleep 2 && qmailctl start
#:<nowiki>#</nowiki> systemctl restart dovecot
#:<nowiki>#</nowiki> systemctl restart httpd


<pre>
#!/bin/bash


1) Create a private key using the triple des encryption standard (recommended):
LOG=/usr/command/certs/certs.log
# openssl genrsa -des3 -out servercert.key.enc 1024
days=3


2) Remove the pass phrase from the private key:
today=`date`
# openssl rsa -in servercert.key.enc -out servercert.key
today=`date --date="$today" --utc +%s`
CD=/etc/letsencrypt/live
FC=fullchain.pem
PK=privkey.pem


3) Generate Certificate Request
mailcert () {
# openssl req -new -key servercert.key -out servercert.csr
  if [[ "`cat /etc/os-release | grep VERSION_ID | sed 's/VERSION_ID=//' | sed 's/"//g'`" == *"9"* ]]
  then
      cat $CD/$1/$FC $CD/$1/$PK > ./servercert.pem
  else
      cat $CD/$1/$PK $CD/$1/$FC > ./servercert.pem
  fi
  cp -p /var/qmail/control/servercert.pem /var/qmail/control/servercert.pem.bak
  cp ./servercert.pem  /var/qmail/control/servercert.pem
  systemctl reload dovecot 
  qmailctl stop && sleep 2 && qmailctl start
}


4) Go to [http://www.discountwebcerts.com/idev/idevaffiliate.php?id=135 DiscountWebCerts] and submit servercert.csr for a trusted certificate ($19.95). You will then receive a servercert.crt. Now just do the following.
for CDOM in `ls $CD`
do
  [ "$CDOM" = "README" ] && continue
  exp=`openssl x509 -dates -noout < $CD/$CDOM/$FC | grep notAfter | sed 's/notAfter=//'`
  off=`date --date="$exp" --utc +%s`
  diff=$(( (off - today)/86400 ))
  echo "Certificate Domain: $CDOM, Days to expire: $diff"
  echo ""
  if [ $diff -le $days ]
  then
      certbot renew --cert-name $CDOM
      systemctl reload httpd
      mailcert $CDOM
  fi
done


5) Create standard .pem in /var/qmail/control/servercert.pem
exit 0
# cat servercert.key servercert.crt > /var/qmail/control/servercert.pem


----------------------
</pre>
*NOTE - For reference, here is the command to sign the request for a self signed certificate:
# openssl x509 -req -days 365 -in servercert.csr -signkey servercert.key -out servercert.crt


Here is an additional resource with some good examples.
=Implementation (qmail run scripts)=
==Submission==
<pre>
#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
export SMTPAUTH="!"


http://www.madboa.com/geek/openssl/#cert-self
exec /usr/bin/softlimit -m 128000000 \
----------------------
    /usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \
    $SMTPD $VCHKPW /bin/true 2>&1
</pre>


----------------------
==SMTPS==
** NOTE - Some certificate providers, like GoDaddy for example, will also give you a chain file (also sometimes called intermediate file), dump it into the same servercert.pem like so:
<pre>
#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
export SMTPS=1
export FORCETLS=0
export SMTPAUTH="!+cram"


cat /etc/pki/tls/private/localhost.key /etc/pki/tls/certs/localhost.crt /etc/pki/tls/certs/intermediate.crt > /var/qmail/control/servercert.pem
exec /usr/bin/softlimit -m 128000000 \
 
    /usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
This will join all three of them: The key, signed certificate and the intermediate certificate. You can use the same certificate you have obtained for your Apache website.
    -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \
-----------------------
    $SMTPD $VCHKPW /bin/true 2>&1
 
</pre>
# chown root:vchkpw /var/qmail/control/servercert.pem
# chmod 640 /var/qmail/control/servercert.pem
 
Note, in order to avoid verification errors in email clients (i.e. Outlook, Thunderbird, etc), you need to use the same server name (FQDN) in your client configuration(s) for both incoming (pop/imap) and outgoing (smtp) servers that was entered as the hostname when the certificate request was created. This should also be the same name that is used on the DNS MX record.
 
That's all there is to it. There is no need to restart qmail.
 
 
You can also use this signed certificate for apache by putting:
* '''servercert.key''' in '''/etc/pki/tls/private/localhost.key'''
* '''servercert.crt''' in '''/etc/pki/tls/certs/localhost.crt'''
Be sure to check your /etc/httpd/conf.d/ssl.conf file to be certain that the correct file names are specified, and that the corresponding parameters are not commented out.
 
You need to restart apache to activate the modified certificate configuration.
 
 
See [http://tldp.org/HOWTO/SSL-RedHat-HOWTO.html Building a Secure Redhat Apache Server HOWTO] for guidance with securing your Apache Server.
 
 
 
'''Self-signed ssl cert''' gleaned from the archives
 
 
Quick-n-dirty how-to for ssl certs
 
# cd /usr/share/ssl/certs
 
# make stunnel.pem
# mv stunnel.pem /var/qmail/control/servercert.pem
 
Then run these commands to finish:
 
# cd /var/qmail/control
 
# chown root:qmail /var/qmail/control/servercert.pem
 
# chmod 644 /var/qmail/control/servercert.pem
 
# ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem
 
And that should take care of it for you...good till next year.
 
 
 
* Jake - I changed the link for the certs to [http://www.discountwebcerts.com/idev/idevaffiliate.php?id=135 DiscountWebCerts]. I've used them before and signed up for an affiliate account. When you purchase a cert from them, we earn 5% of the total sale. They offer single root certs (not chained certs like GoDaddy and others) and they're fast. I had my cert in literally 15 minutes.
 
* Jake - As a side note, I've used RegFly (RapidSSL) a couple times for SSL certs, and there is always an issue that requires helpdesk intervention (~24 hours). I have never had one work in the 5 minutes they advertise. Just be aware.  I have been using [http://www.freessl.com/ssl-certificate-products/free-ssl/freessl.htm FreeSSL] during the wait periods. They offer a free 30-day certificate signed by a major CA that can be used until you get the other certificate straightened out, and they really do give you a cert in 5 minutes after the phone call verification.
 
* I recently tried this with RegFly and I have not been able to get the certificate from them nor a response from their support desk , nor my money back. I would advise people to avoid this company.
 
* Jake - I second this. I purchased a cert from them and have not received the cert nor my money refunded after 30 days of fighting with their support.
 
----------------------
*NOTE - How to create an OUTLOOK certificate for import to avoid outlook certificate warnings:
# openssl pkcs12 -export -in servercert.crt -inkey servercert.key -out OutlookSMTP.p12
 
Then import the OutlookSMTP.p12 file into the Trusted Root Certification Authorities store within Internet Explorer (Tools -> Internet Options -> Content -> Certificates, or by just double-clicking it). You will then be free to establish an SSL connection within Outlook to enforce tighter security.
----------------------

Revision as of 12:41, 20 March 2024

Security Certificate

  1. Abstract: Create Certificate
    Generate key
    Generate signing request
    Sign the key
    Create server certificate
    Set permission
    Set owner
    Copy into place
    Restart services
    Implementation
    1. Self-Signed Certificate
      # openssl genrsa -out x.key 2048
      # openssl req -new -key x.key -out x.csr
      # openssl x509 -req -days 3650 -in x.csr -signkey x.key -out x.crt
      # cat x.crt x.key > servercert.pem
      # chmod 644 servercert.pem
      # chown root:qmail servercert.pem
      # cp -p servercert.pem /var/qmail/control
    2. Let's Encrypt (Assumes working web server)
      # yum install python-certbot-apache
      # certbot -apache -d mydomain.com -d mail.mydomain.com
      Apache
      SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
      SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
      SSLCertificateChainFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
      Dovecot
      ssl_cert = </etc/letsencrypt/live/mydomain.com/fullchain.pem
      ssl_key = </etc/letsencrypt/live/mydomain.com/privkey.pem
      Qmail
      # cp -p /var/qmail/control/servercert.pem /var/qmail/control/servercert.pem.bak
      EL 7/8
      # cat /etc/letsencrypt/live/mydomain.com/privkey.pem /etc/letsencrypt/live/mydomain.com/fullchain.pem > /var/qmail/control/servercert.pem
      EL 9
      # cat /etc/letsencrypt/live/mydomain.com/fullchain.pem /etc/letsencrypt/live/mydomain.com/privkey.pem > /var/qmail/control/servercert.pem
      Cron auto renew (script below)
      0 0 * * * /opt/certbot/certbot renew
    3. Application: Godaddy Signed Certificate
      # openssl genrsa -out x.key 2048
      # openssl req -new -key x.key -out x.csr
      Submit signing request (x.csr) to Godaddy; Later download signed key (crt and crt bundle)
      # cat x.key 7531fdb8504afe19.crt gd_bundle-g2-g1.crt > servercert.pem
      # chmod 644 servercert.pem
      # chown root:qmail servercert.pem
      # cp -p servercert.pem /var/qmail/control
  2. Restart Qmail and Dovecot
    # qmailctl stop && sleep 2 && qmailctl start
    # systemctl restart dovecot
    # systemctl restart httpd
#!/bin/bash

LOG=/usr/command/certs/certs.log
days=3

today=`date`
today=`date --date="$today" --utc +%s`
CD=/etc/letsencrypt/live
FC=fullchain.pem
PK=privkey.pem

mailcert () {
   if [[ "`cat /etc/os-release | grep VERSION_ID | sed 's/VERSION_ID=//' | sed 's/"//g'`" == *"9"* ]]
   then
      cat $CD/$1/$FC $CD/$1/$PK > ./servercert.pem
   else
      cat $CD/$1/$PK $CD/$1/$FC > ./servercert.pem
   fi
   cp -p /var/qmail/control/servercert.pem /var/qmail/control/servercert.pem.bak
   cp ./servercert.pem  /var/qmail/control/servercert.pem
   systemctl reload dovecot  
   qmailctl stop && sleep 2 && qmailctl start
}

for CDOM in `ls $CD`
do
   [ "$CDOM" = "README" ] && continue
   exp=`openssl x509 -dates -noout < $CD/$CDOM/$FC | grep notAfter | sed 's/notAfter=//'`
   off=`date --date="$exp" --utc +%s`
   diff=$(( (off - today)/86400 ))
   echo "Certificate Domain: $CDOM, Days to expire: $diff"
   echo ""
   if [ $diff -le $days ]
   then
      certbot renew --cert-name $CDOM
      systemctl reload httpd
      mailcert $CDOM
   fi
done

exit 0

Implementation (qmail run scripts)

Submission

#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
export SMTPAUTH="!"

exec /usr/bin/softlimit -m 128000000 \
    /usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \
    $SMTPD $VCHKPW /bin/true 2>&1

SMTPS

#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
export SMTPS=1
export FORCETLS=0
export SMTPAUTH="!+cram"

exec /usr/bin/softlimit -m 128000000 \
    /usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \
    $SMTPD $VCHKPW /bin/true 2>&1
Retrieved from "http://wiki.qmailtoaster.org:80/index.php?title=Certificate&oldid=292"