Q1701: I am trying to set up an Exim server that uses a self-signed certificate to enable my clients to use TLS. However, clients other than Exim refuse to accept this certificate. What's wrong?
A1701: It seems that some clients require that the certificate presented by the server be a user (also called ``leaf'' or ``site'') certificate, and not a self-signed certificate. In this situation, the self-signed certificate must be installed on the client as a trusted root certification authority (CA), and the certificate used by the server must be a user certificate signed with that self-signed certificate.
For information on creating self-signed CA certificates and using them to sign user certificates, see the General implementation overview chapter of the Open-source PKI book, available online at http://ospkibook.sourceforge.net/. Here is a quick overview. First, read this message:
http://www.FreeBSD.org/cgi/mid.cgi?id=3C3F3A93.C1ECF9B0%40mindspring.com
Then, follow the instructions found on these two (consecutive) pages:
http://ospkibook.sourceforge.net/docs/OSPKI-2.4.6/OSPKI/initialisation.htm http://ospkibook.sourceforge.net/docs/OSPKI-2.4.6/OSPKI/keygensign.htm
Two points on the PKI Book literature:
(1) It's assumed that it's okay to use a passphrase-protected key to encrypt the user/site/leaf certificate. If this isn't acceptable, you seem to be able to strip out the passphrase as follows:
openssl rsa -in user.key -our user.key.new mv user.key.new
This should be done immediately after user.key is created.
(2) The sign.sh script is available in the mod_ssl distribution, available at http://www.modssl.org/source/.
Having followed the instructions, you end up with the following files:
(a) ca.crt
This file should be installed into the client software as a trusted root certification authority. In Windows XP, this can be done as follows:
Call the file ca_cert.cer
Double-click on the file
"Install Certificate";
"Next"
"Place all certificates in the following store"
"Browse..."
"Trusted Root Certification Authorities"
"OK"
"Next"
"Finish"
"Yes"
"OK"
(b) user.crt and user.key
These files should be installed into the server software. In Exim, this can be done by adding these lines to the configuration file:
tls_certificate = /usr/local/etc/exim/tls_cert tls_privatekey = /usr/local/etc/exim/tls_key
Then install user.crt and user.key under the names tls_cert and tls_key in the appropriate directory.
Q1702: How can I arrange for Exim to advertise support for SMTP authentication only when the session is encrypted?
A1702: Use this setting:
auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}
Q1703: I have some legacy clients that don't use STARTTLS, but which expect to negotiate a TLS session automatically on connection to the ssmtp port (465). Can Exim handle this?
A1703: The -tls-on-connect option is available to handle this. You need to run two instances of an Exim listener, listening on different ports, one of which is started with -tls-on-connect. You can either use two daemons, or a single daemon, with the other listenever using inetd. For example, here are commands to start two daemons:
exim -bd -q15m exim -bd -oX '[0.0.0.0]::465' -tls-on-connect
The first is a ``normal'' daemon; the second listens on port 465 and expects to negotiate a TLS session at the start of each connection.