☰

Dovecot SSL 证书问题：验证返回代码：2（无法获取颁发者证书）

tag-icon • tag-icon ssl ssl-certificate dovecot
Dovecot SSL 证书问题：验证返回代码：2（无法获取颁发者证书）

抱歉，但我是 SSL 新手，我做错了什么？我尝试将 dovecot imap 登录更改为 imaps，但 SSL 证书检查出现问题。SSL 证书适用于 https apache 服务器，我尝试为 dovecot 使用的证书也是相同的。我试图理解 dave thomson 的回答https://stackoverflow.com/questions/47108886/openssl-s-client-error-verify-errornum-2unable-to-get-issuer-certificate但对于新手来说这很难。也许你有更简单的方法。谢谢和br

openssl s_client -connect <my-domain>:993 -servername <my-domain> -CAfile /etc/apache2/ssl/cert_2021.ca-bundle

输出：

CONNECTED(00000003)
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify error:num=2:unable to get issuer certificate
issuer= C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
issuer= C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=0 CN = <my-domain>
issuer= C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
verify return:1
---
Certificate chain
0 s:CN = <my-domain>
i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
---
Server certificate
-----BEGIN CERTIFICATE-----
...gJaprVUs
-----END CERTIFICATE-----
subject=CN = <my-domain>

issuer=C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2192 bytes and written 397 bytes
Verification error: unable to get issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 2 (unable to get issuer certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
Session-ID: 3B8DCD9A603FF577C1E77F40C5D3BCE2B9BAE026EF430566359B0D82353CE1E5
Session-ID-ctx:
Resumption PSK: 69E09...34D1
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 97 86 ca 30 d9 1e 13 95-51 b3 06 87 9d 9f fe ec   ...0....Q.......
...
00d0 - 26 69 ba 7b 58 58 2c da-18 90 c9 8b 9f e2 3f be   &i.{XX,.......?.

Start Time: 1651046361
Timeout   : 7200 (sec)
Verify return code: 2 (unable to get issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
Session-ID: F834...EE6E
Session-ID-ctx:
Resumption PSK: A6FBE...23BF
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 97 86 ca 30 d9 1e 13 95-51 b3 06 87 9d 9f fe ec   ...0....Q.......
...
00d0 - a9 74 d9 44 c8 40 43 11-48 32 1e e2 2a 8f b9 bb   [email protected]..*...

Start Time: 1651046361
Timeout   : 7200 (sec)
Verify return code: 2 (unable to get issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Raspbian) ready.
* BYE Disconnected for inactivity.
closed

用于其他尝试

openssl s_client -connect <my-domain>:993 -servername <my-domain> -CApath /etc/ssl/certs/ | grep 'returncode'

我得到了相同的输出：

depth=0 CN = <my-domain>
verify error:num=20:unable to get local issuer certificate
...
..
.
Start Time: 1651049986
Timeout   : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0

我的

/etc/dovecot/conf.d/10-ssl.conf

具有最小的 cfg

ssl = required
ssl_cert = </etc/apache2/ssl/cert_2021.crt
ssl_key = </etc/apache2/ssl/cert_2021.key
ssl_client_ca_file = /etc/apache2/ssl/cert_2021.ca-bundle
ssl_dh = </usr/share/dovecot/dh.pem

更新：

输入后安克斯我把所有的东西都放在一个文件中。这意味着 crt、key 和 ca-bundle 信息可以通过复制 + 粘贴顺利地保存。保存时/etc/dovecot/private没有任何符号链接。在/etc/dovecot/conf.d/10-ssl.conf我设置下

ssl_cert = </etc/dovecot/private/all_certs_in_one.txt
#ssl_client_ca_file = /etc/apache2/ssl/es_2021.ca-bundle

我尝试了命令

openssl s_client -showcerts 6-connect <my-domain>:993 -servername <my-domain>

我得到了那个输出，肯定比最后一个更多......

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 
322 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

更新-一半解决方案

nano mkcert.sh

#!/bin/sh
# Generates a self-signed certificate.
# Edit dovecot-openssl.cnf before running this.
umask 077
OPENSSL=${OPENSSL-openssl}
SSLDIR=${SSLDIR-/etc/ssl}
OPENSSLCONFIG=${OPENSSLCONFIG-dovecot-openssl.cnf}

CERTDIR=$SSLDIR/certs
KEYDIR=$SSLDIR/private

CERTFILE=$CERTDIR/dovecot.pem
KEYFILE=$KEYDIR/dovecot.pem

if [ ! -d $CERTDIR ]; then
  echo "$SSLDIR/certs directory doesn't exist"
  exit 1
fi

if [ ! -d $KEYDIR ]; then
  echo "$SSLDIR/private directory doesn't exist"
  exit 1
fi

if [ -f $CERTFILE ]; then
  echo "$CERTFILE already exists, won't overwrite"
  exit 1
fi

if [ -f $KEYFILE ]; then
  echo "$KEYFILE already exists, won't overwrite"
  exit 1
fi

$OPENSSL req -new -x509 -nodes -config $OPENSSLCONFIG -out $CERTFILE -keyout $KEYFILE -days 3650 || exit 2
chmod 0600 $KEYFILE
echo
$OPENSSL x509 -subject -fingerprint -noout -in $CERTFILE || exit 2

nano dovecot-openssl.cnf

[ req ]
default_bits = 2048
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no

[ req_dn ]
# country (2 letter code)
#C=FI

# State or Province Name (full name)
#ST=

# Locality Name (eg. city)
#L=Helsinki

# Organization (eg. company)
O=<MY FIRM NAME>

# Organizational Unit Name (eg. section)
OU=IMAP server

# Common Name (*.example.com is also possible)
CN=mail.<YOUR DOMAIN NAME>

# E-mail contact [email protected] 
emailAddress=support@<YOUR DOMAIN NAME>

[ cert_type ]
nsCertType = server

创建符号链接：

ln -s /etc/ssl/certs/dovecot.pem /etc/dovecot/private/dovecot_pem_sym.pem
ln -s /etc/ssl/private/dovecot.pem /etc/dovecot/private/dovecot_pem_sym.key

nano /etc/dovecot/conf.d/10-ssl.conf

ssl = required
ssl_cert = </etc/dovecot/private/dovecot_pem_sym.pem
ssl_key = </etc/dovecot/private/dovecot_pem_sym.key
#ssl_client_ca_dir = /etc/ssl/certs
#ssl_client_ca_file =
#ssl_dh = </usr/share/dovecot/dh.pem

重新开始

systemctl restart dovecot

测试

openssl s_client -showcerts -connect <YOUR mail.DOMAIN>:993 -servername <YOUR mail.DOMAIN>

错误代码是

Verify return code: 18 (self signed certificate)

但这总比没有好 =/ 我的 apache 证书不起作用，但是是的。似乎我们不能让所有东西都正常工作 =（

顺便说一句。不要忘记在 Outlook 中将 @cfg 设置method为非SSL/TLS自动

答案1

您可能ssl_client_ca_file错误地使用了该设置。当 Dovecot 在以下情况下建立传出连接时使用它：客户角色（例如，代理到 MTA/IMAP 目标，而系统默认 CA 不合适）。这与 Dovecot 处理传入连接的配置完全不同服务器角色，例如通过 TLS 提供 IMAP 服务。

保留该设置，而是连接您的服务器和中间证书合并为一个文件以供使用ssl_cert=</path/to/file。

注意顺序，就你的情况而言，我相信那将是你的服务器证书，然后塞克蒂戈， 然后用户信任。由于您当前指向的是 apache2 使用的文件，因此请注意不要修改您在其他地方配置的文件（期望它们仅包含服务器证书或链）。

相关内容