Setting up Transport Layer Security (TLS), or as previously known as Secure Sockets Layer (SSL), for Apache, Postfix and IMAP like Dovecot is fairly easy. You just need some digital certificates and configuration. If you don’t want to pay for certificates from trusted sources like Thawte or you just don’t need that kind of trust (for development purposes), you can always produce your own certificates. But there is also a middle way: using CAcert.org signed certificates.
Background
Wikipedia tells us that CAcert.org is a community-driven certificate authority that issues free public key certificates. CAcert automatically signs certificates for email addresses controlled by the requester and for domains for which certain addresses (such as “hostmaster@example.com”) are controlled by the requester. Thus it operates as a robot certificate authority. CAcert certificates can be used like any other SSL certificates although they are considered weak because CAcert does not emit any information in the certificates other than the domain name or email address. To create higher-trust certificates, users can participate in a web of trust system whereby users physically meet and verify each other’s identities. They are also not as useful in web browsers as certificates issued by commercial CAs such as VeriSign, because most installed web browsers do not distribute CAcert’s root certificate. Thus, for most web users, a certificate signed by CAcert behaves like a self-signed certificate.
Generating Certificates
The procedure to sign your certificate at CAcert is rather simple. This guide assumes that the certificates are in /etc/ssl/cacert/ and you are as root.
0. Join CAcert.org and fill in your details. After email verification and login, add domain and service will try to verify that you can read mail on one of following accounts: root, hostmaster, postmaster, admin, webmaster or email addresses that can be found on whois data of domain that you provided.
1. Generate a private key that is not file encrypted:
openssl genrsa -out domainname.key 1024
chown root:root domainname.key
chmod 0400 domainname.key
Private keys should belong to “root” and be readable only by root.
You could also create a private key that is encrypted: openssl genrsa -des3 -out domainname.key 1024
2. Create a CSR with the RSA private key (output will be PEM format). Do not enter extra attributes at the prompt and leave the challenge password blank (press enter):
openssl req -new -key domainname.key -out domainname.csr
3. Verify the contents of the CSR or private key:
openssl req -noout -text -in domainname.csr
openssl rsa -noout -text -in domainname.key
4. Send your public key to be signed by and request new server certificate from CAcert.org web site (Class 1 certificate). When you are asked for CSR paste content of domainname.csr. It should look like this:
-----BEGIN CERTIFICATE REQUEST----- MIIB3TCCAUYCAQAwgZwxCzAJBgNVBAYTAkZJMRAwDgYDVQQIEwdVdXNpbWFhMQ8w ...clip... MQ== -----END CERTIFICATE REQUEST-----
You can verify the content of request before sending it
openssl req -in domainname.csr -text -verify -noout
5. Copy the Server Certificate from the CAcert.org webpage and put it in domainname.crt file and add permissions.
chmod a=r domainname.crt
Check at least the contents of Validity and Subject fields:
openssl x509 -in domainname.crt -text -noout
6. Get CAcert.org root certificate
wget -nv https://www.cacert.org/certs/root.crt -O cacert-org.crt
chmod a=r cacert-org.crt
Check the contents:
openssl x509 -in cacert-org.crt -text -noout
After that you’re ready to configure your services like Apache, Postfix and Dovecot to use the new certificate. Read about it later.
Leave a Reply