0

I'm trying to create the self-signed server certificate for the Postfix user:

thufir@dur:~$ 
thufir@dur:~$ sudo ./tls.script 
Error opening Private Key 
3073578684:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('','r')
3073578684:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load Private Key
thufir@dur:~$ 
thufir@dur:~$ nl tls.script 
     1  # dir="$(postconf -h config_directory)"
     2  # fqdn=$(postconf -h myhostname)
     3  # case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
     4  # ymd=$(date +%Y-%m-%d)
     5  # key="${dir}/key-${ymd}.pem"; rm -f "${key}"
     6  # cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
     7  # (umask 077; openssl genrsa -out "${key}" 2048) &&
     8    openssl req -new -key "${key}" \
     9      -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
    10    postconf -e \
    11      "smtpd_tls_cert_file = ${cert}" \
    12      "smtpd_tls_key_file = ${key}"

thufir@dur:~$ 

as per the Postfix quick-start on TLS.

thufir@dur:~$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
default_transport = error
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command =
mailbox_size_limit = 0
mailman_destination_recipient_limit = 1
mydestination = dur.bounceme.net, localhost.bounceme.net, localhost
myhostname = dur.bounceme.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relay_domains = lists.dur.bounceme.net
relay_transport = error
relayhost =
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_loglevel = 2
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
thufir@dur:~$ 

Do I need to run the script from a certain location? I was just running it from my home directory, with sudo.

Incidentally, I would be ok with using the snake oil certificate.

  • 1
    Uh, those # signs in the Howto are supposed to represent the prompt. They're not meant to be part of a script. Each # represents the beginning of a new command. – muru Jun 17 '14 at 2:57
1

Fixed the issue using the helpful reply of muru in a comment.

Uh, those # signs in the Howto are supposed to represent the prompt. They're not meant to be part of a script. Each # represents the beginning of a new command.

thufir@dur:~$ 
thufir@dur:~$ sudo ./tls.script 
[sudo] password for thufir: 
Generating RSA private key, 2048 bit long modulus
....................................................................+++
.........................................+++
e is 65537 (0x10001)

The content of tls.script should be like this (without the leading # marks as in the question)

    dir="$(postconf -h config_directory)"
    fqdn=$(postconf -h myhostname)
    case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
    ymd=$(date +%Y-%m-%d)
    key="${dir}/key-${ymd}.pem"; rm -f "${key}"
    cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
    (umask 077; openssl genrsa -out "${key}" 2048) &&
     openssl req -new -key "${key}" \
       -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
    postconf -e \
      "smtpd_tls_cert_file = ${cert}" \
      "smtpd_tls_key_file = ${key}"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.