Ralf Hildebrandt's Amazon Blog

« Go to Ralf Hildebrandt's full Amazon Blog

x509 Certificate woes

12:51 AM PDT, May 20, 2007, updated at 12:33 PM PDT, May 21, 2007

The Charite uses x.509 certificates that were signed by the DFN-PCA
That means that our mailservers use such x.509 certificates to encrypt their traffic. Unfortunately I didn't bother to add the CA-certificates, which means that Postfix ends up complaining about being unable the authenticity of the certificates the mailservers are presenting each other.
So Fridtjof and I spent some time adding these CA certificates "the Debian way"; this means:

find the CA certificates on the CA's website
copy them to a subdirectory "dfn-pca" below /usr/share/ca-certificates
dpkg-reconfigure ca-certificates
trust the newly added CAs

After these steps, all you need to do is to tell Postfix to use the file /etc/ssl/certs/ca-certificates.crt for both smtp and smtpd:

smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

update-ca-certificates regenerates the /etc/ssl/certs/ca-certificates.crt file automatically from all the trusted CA certificates.
Don't forget postfix reload to ensure that the new certificates are being used without delay.

.jsOffDisplayBlock { display: block; } .jsOffDisplayInline { display: inline; } .jsOffVisibility { visibility: visible; } .jsOnDisplayBlock { display: none; } .jsOnDisplayNoneBlock { display: block; } .jsOnDisplayNoneInline { display: inline; } .jsOnDisplayInline { display: none; } .jsOnVisibility { visibility: hidden; } .jqOnDisplayBlock { display: none; } .jqOnDisplayInline { display: none; } .jqOnVisibility { visibility: hidden; } .jqOnDisplayNoneBlock { display: block; } .jqOnDisplayNoneInline { display: inline; }

Ralf Hildebrandt's Amazon Blog

x509 Certificate woes

Bio

Where's My Stuff?

Shipping & Returns

Need Help?