Version 5 (modified by 12 years ago) ( diff ) | ,
---|
How are x509 certificates and key files handled on MOSH servers?
MOSH servers are configured to provide apache, postfix and courier services on a single server.
All three programs rely on the same x509 certificates and the same keys, however, they reference these keys in three different ways.
All MOSH servers should have the following files:
- /etc/ssl/HOST.mayfirst.org.crt: contains both the TLS certificate and any required intermediary certificates (server cert first, intermediary second)
- /etc/ssl/private/HOST.mayfirst.org.pem: contains both the key file and the TLS certificate and any required intermediary certificates (in that order)
- /etc/ssl/HOST.mayfirst.org.csr: certificate signing request, used to request a new certificate when the existing one expires
On a new server, puppet will generate /etc/ssl/private/HOST.mayfirst.org.uncertified.key and /etc/ssl/HOST.mayfirst.org.csr. In addition /etc/ssl/HOST.mayfirst.org.crt is create as a symlink to /etc/ssl/cert/ssl-cert-snakeoil.pem and /etc/ssl/private/HOST.mayfirst.org.pem is a symlink to /etc/ssl/private/ssl-cert-snakeoil.key.
A sysadmin is required to submit the certificate signing request to rapidssl.com (or another vendor). Once the sys admin has the certificate, s/he should replace the symlinked files with the appropriate files (e.g. replace the /etc/ssl/HOST.mayfirst.org.crt symlink with a file containing the actual certificate and any intermediary certificates and delete the /etc/ssl/private/HOST.mayfirst.org.pem symlink, move HOST.mayfirst.org.uncertified.key to HOST.mayfirst.org.pem, and add both the certificate and any intermediary certificates to that file.
If, for some reason, the MOSH server is using a common name other than HOST.mayfirst.org (e.g. secure.critpath.org is used instead of didier.mayfirst.org), then the files should be named after the common name (secure.critpath.org) and HOST.mayfirst.org should be a symlink to the actual file. This naming convention helps us easily identify what common name the certificates should be presenting.
Service configuration
- courier: /etc/courier/imapd-ssl and /etc/courier/pop3d-ssl:
TLS_CERTFILE=/etc/ssl/private/HOST.mayfirst.org.pem
- apache: /etc/apache2/sites-available/HOST.mayfirst.org.ssl:
SSLCertificateFile=/etc/ssl/HOST.mayfirst.org.crt SSLCertificateChainFile=/etc/ssl/HOST.mayfirst.org.crt SSLCertificateKeyFile=/etc/ssl/private/HOST.mayfirst.org.pem
- postfix: /etc/postfix/main.cf:
smtpd_tls_cert_file=/etc/ssl/HOST.mayfirst.org.crt smtpd_tls_key_file=/etc/ssl/private/HOST.mayfirst.org.pem