Now with new Certificates

It shouldn’t be a new topic to secure your data while sending it across public lines like the internet. This usually happens using server certificates, which are made once and never touched again - if self signed. In my case I wanted to do it better and got me a certificate from CACert.org. At least it is a good exercise to do before changing to a big and expensive one.

The procedure itself isn’t something new - the only difference is that you don’t sign the certificate yourself. We start (as usual) with a certificate request:

openssl req -nodes -new -keyout server.key -out server.csr

This request - filed so server.csr is now passed on to CACert, who now generates and signs the certificate for us. Using it on our server isn’t a big deal as long as our clients got the root certificate to validate it. If they don’t, it is very easy to get it:

wget -nv https://www.cacert.org/certs/root.crt -O /etc/ssl/certs/CAcert.org_Root_Certificate.pem

The rest is pretty straight forward. Here is an example for doing it with postfix:

# TLS PART START smtp_tls_CAfile = /etc/postfix/tls/root.crt smtp_tls_cert_file = /etc/postfix/tls/server.pem smtp_tls_key_file = /etc/postfix/tls/key.pem smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache smtp_use_tls = yes

smtpd_tls_CAfile = /etc/postfix/tls/root.crt smtpd_tls_cert_file = /etc/postfix/tls/server.pem smtpd_tls_key_file = /etc/postfix/tls/key.pem smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache smtpd_use_tls = yes

smtpd_tls_received_header = yes smtpd_tls_ask_ccert = yes smtpd_tls_loglevel = 1

tls_random_source = dev:/dev/urandom

TLS PART END

After doing a reload, we can proceed to the test which has been passed by my system already. As anything is set up and shouldn’t need to be changed until a new certificate comes in, I’m done and so I sit there saying ‘safe paths’ to my files passing by.