☰

每个域名的 Dovecot 证书

tag-icon • tag-icon ssl-certificate email-server dovecot debian-stretch
每个域名的 Dovecot 证书

我的邮件服务器（postfix + dovecot）上有多个域，我想为每个域分配特定的证书。

根据 dovecot 文档，我尝试了以下配置：

local_name smtp.domain1.com {
  ssl_cert = </etc/ssl/certs/domain1.com-cert.pem
  ssl_key = </etc/ssl/private/domain1.com-privkey.key
  ssl_ca = </etc/ssl/certs/domain1.com-chain.pem
}

local_name smtp.domain2.com {
  ssl_cert = </etc/ssl/certs/smtp.domain2.com-cert.pem
  ssl_key = </etc/ssl/private/smtp.domain2.com-privkey.key
  ssl_ca = </etc/ssl/certs/smtp.domain2.com-chain.pem
}

但它不起作用。当我尝试连接到网络邮件（roundcube）时返回此错误：

Apr 22 22:36:06 localhost dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: ANY PRIVATE KEY
Apr 22 22:36:06 localhost dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs

当我尝试使用 openssl s_client 时：

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1524436845
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

没有local_name（只有1组证书），一切正常。

我的配置有什么问题？

答案1

我在 dovecot.conf 中添加了以下行：

!include /etc/dovecot/conf.d/*.conf

最后删除

ssl_cert = </path/to/cert.pem
ssl_key =</path/to/key.pem
ssl_protocols = !SSLv3

（在 10-ssl.conf 中取消注释同一行之后）

现在就可以使用了

相关内容