0

I have nice iRedMail server (postfix, dovecot, policyd). One of my client apps sends email via this server. And client want to sign it with digital signature on server side. Is it even possible to do what he wants?

B14D3
  • 5,188
  • 15
  • 64
  • 83
  • I have one more question ... what in your opinion is better doing this on mta server side or they should build code on aplications side that will be mailing already signed mails ? – B14D3 Mar 29 '12 at 10:05

4 Answers4

2

It's possible, using an encryption gateway. Several products are available for Postifx. I've had some experience with Djigzo, works great.

  • 1
    I would never store my personal certificate in Djigzo and trust someone to sign my emails. A private key is private by definition. Since emails to Djigzo are sent unsigned and unencrypted how can I be sure that only my (really sent from me) emails are signed? – Matteo Mar 29 '12 at 08:51
  • True, it really depends on the circumstances which approach is best. The security of the private key depends on the security of the system it is stored on. Also, an encryption gateway can be used enforce an organization-wide encryption policy. –  Mar 29 '12 at 08:57
  • Ok if I understand it is possible but I have to install and configure another server with software do signing mails ? – B14D3 Mar 29 '12 at 09:05
  • @B14D3 A separate server would be ideal, but you could also run an additional daemon on your mail server. –  Mar 29 '12 at 09:08
1

What you are asking for is called an S/MIME gateway and there are some add-ons to postfix to do exactly that.

This said, if all you need is a signed mail from a client application where the source code is controlled by you, you really should look into enabling S/MIME in your e-mail composition routines. As an example, the openssl command line utility has an smime mode allowing for signing, verifying, encrypting and decrypting S/MIME messages - you could simply insert an appropriately formed command into your mail sending routine.

the-wabbit
  • 40,737
  • 13
  • 111
  • 174
1

Leaving aside the fact that the practice of signing on an MTA is rather dubious - checkout signing-milter (any MTA supporting milters) and anubis (an MTA proxy)

symcbean
  • 21,009
  • 1
  • 31
  • 52
  • Is there any specific concern regarding signing on MTA side ? – majkinetor Sep 26 '18 at 14:41
  • Yes - signing is there to prove the origin of a message - the MTA sits in the middle of the communication - not at the end points. – symcbean Sep 26 '18 at 14:47
  • Semantics, not necessarily concern. In companies, its sometimes required that every output is signed the same way and its way harder to make it work for each user inside. – majkinetor Oct 03 '18 at 17:06
  • Required by whom. Good luck selling that one in a court. – symcbean Oct 04 '18 at 08:44
0

To sign an email you need the private key which should not be shared. If you distribute your private key (by putting it on a mail server) the mail agent would be able to use the key (has read access) to sign every email: bad idea.

A private key is private by definition and your client should sign his own email.

Matteo
  • 467
  • 3
  • 14