5

Following this tutorial: https://www.vultr.com/docs/simple-mailserver-postfix-dovecot-sieve-debian

Trying to create a self-signed SSL certificate for testing purposes for my mail server, using code:

openssl req -newkey rsa:4096 -sha512 -x509 -days 365 -nodes -keyout /etc/dovecot/private/mykey.key -out /etc/dovecot/mycert.pem

Now, modifying Postfix and Dovecot config files. What I don't understand is how this code:

smtpd_tls_cert_file = /etc/dovecot/private/mykey.pem
smtpd_tls_key_file = /etc/dovecot/private/mycert.pem
smtpd_use_tls = yes

And this code:

ssl = yes
ssl_key = /etc/dovecot/private/mykey.pem
ssl_cert = /etc/dovecot/private/mycert.pem

suppose to work? First of all there is only one file created - /etc/dovecot/private/mykey.key.

May be someone can explain what files does one suppose to get after running openssl command - PEM of KEY file?

EDIT: I understood that the result of this command:

openssl req -newkey rsa:4096 -sha512 -x509 -days 365 -nodes -keyout /etc/dovecot/private/mykey.key -out /etc/dovecot/mycert.pem

should be 2 files generated - mykey.pem (unsigned key) and mycert.pem (self-signed certificate), but it is not happening. I have done it in different way:

openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out csr.pem
openssl req -x509 -days 365 -key key.pem -in csr.pem -out certificate.pem

But curious why is this shortcut-code not working? Where is the syntax mistake?

0leg
  • 163
  • 1
  • 1
  • 6
  • 2
    Both. But you didn't do your homework: howtos describing the self-signed certificate creation are widespread all over the internet. *google://openssl self-signed certificate*. – drookie Jan 26 '16 at 18:44
  • I was curious if the command ran successfully, since I've got only `mykey.key` – 0leg Jan 26 '16 at 18:50
  • 1
    Hopefully silly question - you do realise the certificate file is being written to a different directory (/etc/dovecot) than the key file (/etc/dovecot/private), right? – andytech Jan 27 '16 at 05:40
  • 1
    @andytech Oh... OH!!!! And this is what happens when you look at the thing for too long.. you misses the obvious. – 0leg Jan 27 '16 at 08:41

1 Answers1

1

The comments from @drookie and @andytech helped me to solve the issue. There were no errors, just lack of understanding and attention.

After searching for answer even more, I found a good article about SSL-key generation: https://msol.io/blog/tech/create-a-self-signed-ssl-certificate-with-openssl/

Regarding the .pem absence, I have missed that the certificate is generated into /etc/dovecot/cert.pem and not into /etc/dovecto/private/cert.pem.

0leg
  • 163
  • 1
  • 1
  • 6
  • just say the article is wrong that you linked! – Toskan Nov 01 '16 at 21:07
  • jesus christ man! what a waste of time!!! not only is the path wrong, the file format of the file is wrong too! it is `mykey.key` not `mykey.pem` – Toskan Nov 01 '16 at 21:32