Pahwa ssl

The Certificate Got Renewed on 7th DEC 2014 Once again , The Renewal Process is at the Bottom

Objective

• Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl rsa -in servercert.key.enc -out servercert.key

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650 [self signed cert]

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

IMPLEMENTATION OF POP3S

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

To Verify-

openssl s_client -connect localhost:995

IMPLEMENTATION OF IMAPS

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3

TLS_STARTTLS_PROTOCOL=TLS1

TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"

TLS_CERTFILE=/var/qmail/control/servercert.pem

To Verfiy -

openssl s_client -connect localhost:993

SSL IMPLEMENTATION ON APACHE

vim /etc/httpd/conf.d/

SSLEngine on

SSLProtocol -ALL +SSLv3 +TLSv1

SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)

SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

For SMTPS on POSTFIX

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

Test the settings on thunderbird/outlook/evolution

incoming mailserver - mail21c.pahwa.com
outgoing mailserver - mail21c.pahwa.com
smtps port          - 587
imaps port          - 993
pop3s port          - 995
https://mail21c.pahwa.com

Reference http://192.168.1.15/wiki/index.php/Implementation_of_smtps_pop3s_imaps_and_Https_on_Qmail_Based_Server

Renewal of Certificate andits implementation

First down load the Certificate from Godaddy Certificate site with authorization information ( For information get in touch with Biswajit Banerjee )

The Certificate , the Root Certificates and the OLd certicate Key is kept in /certificate/2014-2015

For Postfix - Changes are made in main.cf file by converting "/certicate/.........." to "/certifate/2014-2015/......."

For Apache - Changes are made in /etc/httpd/conf.d/ssl.conf file by converting "/certicate/.........." to "/certifate/2014-2015/......."

For Qmail ( Pop3d and Imap) - From /certificate/2014-2015 directory

cat servercert.key servercert.crt gd_bundle.crt > /var/qmail/control/servercert.pem