-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 brian schrieb: | brian wrote: |> cyrus-imapd-2.3.9-7.fc7 |> openssl-0.9.8b-15.fc7 |> |> I'm trying (and failing) to set up TLS and hope someone might be able to |> shed some light on my problem. Authentication failed so I checked |> maillog and found: |> |> imap[30288]: TLS server engine: cannot load CA data This ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |> imap[30288]: unable to get certificate from |> '/etc/pki/tls/certs/imapcert.pem' and this ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Is your first hint. |> The file imapcert.pem is the self-signed cert created while following |> Patrick Koetter's SMTP AUTH tutorial[1] As it's easily readable (the |> cert, though Patrick's tut has been terrificly helpful), I'm wondering |> if I've made some blunder in creating it. While you can use self signed certs for server authentication, generally speaking it is not good to do. It is better to create a CA certificate and sign your server certificate with it. Arg. I wish people would stop using self signed certificates in their tutorials. Creating a CA and using it to sign the certificates are just two to three steps more and it gives people a hint how to set up things correctly... | I've just noticed that i neglected to add the client part of the test. I | repeated it and paste here: | | # openssl s_server -cert /etc/pki/tls/certs/imapcert.pem -key | /etc/pki/tls/certs/imapkey.pem | | [from 2nd terminal] | # sudo netstat -ntpl | grep :4433 | tcp 0 0 :::4433 :::* LISTEN 7737/openssl | | # openssl s_client -connect localhost:4433 -CApath /etc/pki/CA -CAfile | /etc/pki/CA/cacert.pem While you can use self signed certificates for server authentication, you can not use self signed certificates for client authentication. (besides: you didn't tell the server to do client authentication...) Additionally: On your server you have a self signed cert and now you tell your client to verify it against CA certificates given here ? | [abbreviated output follows] | | CONNECTED(00000003) | depth=1 /C=CA/ST=Ontario/O=zijn | digital/OU=server/CN=MYDOMAIN/emailAddress=root@MYDOMAIN | verify return:1 | depth=0 /C=CA/ST=Ontario/L=Stratford/O=zijn | digital/OU=mail/CN=mail.MYDOMAIN/emailAddress=postmaster@MYDOMAIN | verify return:1 | --- | Certificate chain | 0 s:/C=CA/ST=Ontario/L=Stratford/O=zijn | digital/OU=mail/CN=mail.MYDOMAIN/emailAddress=postmaster@MYDOMAIN | i:/C=CA/ST=Ontario/O=zijn | digital/OU=server/CN=MYDOMAIN/emailAddress=root@MYDOMAIN OK, this is NOT a self signed certificate. | --- | Server certificate | -----BEGIN CERTIFICATE----- | ... | -----END CERTIFICATE----- | subject=/C=CA/ST=Ontario/L=Stratford/O=zijn | digital/OU=mail/CN=mail.MYDOMAIN/emailAddress=postmaster@MYDOMAIN | issuer=/C=CA/ST=Ontario/O=zijn | digital/OU=server/CN=MYDOMAIN/emailAddress=root@MYDOMAIN | --- | No client certificate CA names sent ~ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ You want to do client authentication, but you didn't tell your server which CAs you accept for signing them ? It is obvious that you don't know what you are doing. If you would tell us what you want to do, we might be able to tell you what you should do. Goetz - -- DMCA: The greed of the few outweights the freedom of the many -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFH/8ZN2iGqZUF3qPYRArguAJ9B63sIC8rW3g5TQ9vKQ4mOUogNFACfYN/s 2KS4gtuJf+IBQTp4HxZCR20= =5tB7 -----END PGP SIGNATURE----- ---- Cyrus Home Page: http://cyrusimap.web.cmu.edu/ Cyrus Wiki/FAQ: http://cyrusimap.web.cmu.edu/twiki List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
