☰

Postfix TLS 的自签名服务器证书

tag-icon • tag-icon email postfix ssl certificates tls
Postfix TLS 的自签名服务器证书

我正在尝试为 Postfix 用户创建自签名服务器证书：

thufir@dur:~$ 
thufir@dur:~$ sudo ./tls.script 
Error opening Private Key 
3073578684:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('','r')
3073578684:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load Private Key
thufir@dur:~$ 
thufir@dur:~$ nl tls.script 
     1  # dir="$(postconf -h config_directory)"
     2  # fqdn=$(postconf -h myhostname)
     3  # case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
     4  # ymd=$(date +%Y-%m-%d)
     5  # key="${dir}/key-${ymd}.pem"; rm -f "${key}"
     6  # cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
     7  # (umask 077; openssl genrsa -out "${key}" 2048) &&
     8    openssl req -new -key "${key}" \
     9      -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
    10    postconf -e \
    11      "smtpd_tls_cert_file = ${cert}" \
    12      "smtpd_tls_key_file = ${key}"

thufir@dur:~$

按照Postfix 快速入门 TLS。

thufir@dur:~$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
default_transport = error
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command =
mailbox_size_limit = 0
mailman_destination_recipient_limit = 1
mydestination = dur.bounceme.net, localhost.bounceme.net, localhost
myhostname = dur.bounceme.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relay_domains = lists.dur.bounceme.net
relay_transport = error
relayhost =
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_loglevel = 2
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
thufir@dur:~$

我需要从某个位置运行脚本吗？我只是用 sudo 从我的主目录运行它。

顺便说一句，我可以使用蛇油证书。

答案1

使用以下有用的回复修复了该问题muru 在评论中。

呃，这些#符号在 Howto 中应该代表提示符。它们不是脚本的一部分。每个 # 代表一个新命令的开始。

thufir@dur:~$ 
thufir@dur:~$ sudo ./tls.script 
[sudo] password for thufir: 
Generating RSA private key, 2048 bit long modulus
....................................................................+++
.........................................+++
e is 65537 (0x10001)

的内容tls.script应该是这样的（没有#问题中的前导符号）

    dir="$(postconf -h config_directory)"
    fqdn=$(postconf -h myhostname)
    case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
    ymd=$(date +%Y-%m-%d)
    key="${dir}/key-${ymd}.pem"; rm -f "${key}"
    cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
    (umask 077; openssl genrsa -out "${key}" 2048) &&
     openssl req -new -key "${key}" \
       -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
    postconf -e \
      "smtpd_tls_cert_file = ${cert}" \
      "smtpd_tls_key_file = ${key}"

相关内容