search for: cert

....de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, 23 Nov 2016, Steve Litt wrote: > > >On Wed, 23 Nov 2016 16:04:22 -0600 (CST) Greg Rivers > ><gcr+dovecot at tharned.org> wrote: > >> $ strings $(whence alpine) | grep '^/.*certs$' > >> /etc/ssl/certs > > > > The directory or the certs isn't the problem. Alpine sees the > > self-signed cert I just made, but complains because it's > > self-signed, and gives me the choice between saying "yes" every > > time, and...

I've read the client ssl cert section in the wiki and it talks about using a self signed cert, if I am using a commercial cert, in this case godaddy, how do I implement a self signed cert for the client side and have dovecot make use of this? I know the mechanics of setting up the self signed ca, the question is more what...

I am building a mail server on Centos 6.3 and working with OpenSSL to create a self-signed certificate for mail use. Along the line of learning the 'best' options to use for OpenSSL and dealing with the default SSL virtual host for Apache, I discovered that the localhost cert created (I believe) during firstboot has the X509v3 extensions set as a CA cert (eg basicConstraint CA:TRU...

...at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0xb6b84600 in __GI_abort () at abort.c:79 #2 0x7f715c00 in __subvsi3 (a=<optimized out>, b=<optimized out>) at ../../../gcc-7-20180201/libgcc/libgcc2.c:119 #3 0x7f713494 in strlcpy ( dst=0x7fff2428 "ecdsa-sha2-nistp256-cert-v01 at openssh.com,ecdsa-sha2-nistp384-cert-v01 at openssh.com,ecdsa-sha2-nistp521-cert-v01 at openssh.com,sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,ssh-ed25519-cert-v01 at openssh.com,sk-ssh-ed25519-cert-v01 at openssh.com,rsa-sha2-512-cert-v01 at openssh.com,rsa-sha2-256-cert-v01 at openssh....

After upgrading to 2.31 I'm getting this error. Not sure what I'm doing wrong. No (No signatures could be verified because the chain contains only one certificate and it is not self signed.) ssl = yes ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt local mail.ctyme.com { ? protocol imap { ??? ssl_cert = </etc/exim/certs/ctyme.com.crt ??? ssl_key = </etc/exim/cer...

Hi there! What am I doing wrong? I created a ssh-certificate id_user_rsa-cert.pub with this dump: id_user_rsa-cert.pub: root at host # ssh-keygen -Lf id_user_rsa-cert.pub ??????? Type: ssh-rsa-cert-v01 at openssh.com user certificate ??????? Public key: RSA-CERT SHA256:kPitwgxblaUH4viBoFoozSPq9Pblubbedk ??????? Signing CA: ED25519 SHA256:8p2foobarQo...

Hi, I'm trying to get apache, sendmail , and dovecot to use SSL certs signed by my own CA. I've got the apache certs working fine. However, dovecot ( I haven't even tried sendmail yet) doesn't seem to accept any of the certificates that I create for it. There is a script that comes with dovecot that creates self-signed certificates for you but, I need ce...

Thanks for the response. My current chain is as follows: caroot -> child-ca1 -> server cert My cacert.pem file has both the caroot and the child-ca1 certs. I have recompiled libvirt on my machine with some extra debug statements and verified that both the caroot cert and the child-ca1 certs are being loaded. But when I try to connect the caroot and child-ca1 certs only appear under the &...

Hi, One of our users who is running an OS (I think it's the latest beta macOS 10.14.1) with ssh version "OpenSSH_7.8p1, LibreSSL 2.7.3" is unable to use our user SSH RSA certificates to authenticate to our servers (which are running "OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017"). We see this error on the client side: debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512> ... debug1: Offering public key: RSA-CERT SHA256:xxx /path/to...

Jason Pyeron wrote: >> I'm getting endless complaints about my dovecot cert, > > Exact message please? The certificate does not apply to the given host The certificate is not signed by any trusted certificate authority >> Do I really have to use a separate cert and key for dovecot? >> Can I not use the "standard" cert in /etc/pki/tls/certs (a...

On Wed, 23 Nov 2016 16:04:22 -0600 (CST) Greg Rivers <gcr+dovecot at tharned.org> wrote: > On Wed, 23 Nov 2016, Steve Litt wrote: > > [snip] > > > > Alpine still gives me a bad cert warning, saying I should either > > fix it or disable checking. I haven't yet found a way to get Alpine > > to discriminate between a valid self-signed cert and a bad one. > > > Like a number of applications, alpine checks the system certificates > directory for a fil...

Hi all, I am currently struggling with an odd sieve/Pigeonhole issue. Some weeks ago I had to replace our dovecot certificate due to expiration. In the past I did use a self-signed certificate, but because we now have a little openssl based CA I have decided to create signed certificate for imaps. Dovecot is happily accepting the new certificate which has integrated the whole cert-chain. Unfortunately Pigeonhol...

...The primary and secondary both use the primary as their master. The secondary only is used when the primary isn''t responding (I wrap the puppetd call in cron with a short shell script) I''m managing these ca files on the masters, pushing them with puppet itself... $ grep file\ { certs.pp file { "/var/lib/puppet/ssl/ca/ca_crt.pem": file { "/var/lib/puppet/ssl/ca/ca_key.pem": file { "/var/lib/puppet/ssl/ca/private/ca.pass": file { "/var/lib/puppet/ssl/certs/ca.pem": file { "/var/lib/puppet/ssl/ca/ca_crl.pem":...

You forgot to cc the list. ssl_ca is used only for validating client certificates. ---Aki TuomiDovecot oy -------- Original message --------From: Marc Perkel <marc at perkel.com> Date: 21/05/2018 18:25 (GMT+02:00) To: Aki Tuomi <aki.tuomi at dovecot.fi> Subject: Re: SSL error after upgrading to 2.31 On 05/21/2018 07:54 AM, Aki Tuomi...

...thorizations (and? more importantly, remove them when no longer authorized).? If you're going to do that, it's not too far removed from pushing out ~/.ssh/authorized_keys for each user. I was hoping to avoid the dependency on configuration management by carrying the authorization in the certs themselves - if that is in the spirit of the SSH cert mechanism. On 30/01/2020 16:05, Michael Str?der wrote: > Adding authz information to user certs means that you need to renew the > cert if the authz information changes during cert life-time. This can be > annoying for users. > &...

Can you provide some details on what those openssl commands returned? Aki On 20.07.2018 12:14, Martin Johannes Dauser wrote: > Hi, > > I recognised some funny behaviour on my server. IMAP clients which > won't send an Server Name Indication (SNI) sometimes get the wrong > certificate. I would expect that those clients always get the default > certificate (of my new domain), instead in about 20 to 50% of > connections the certificate of my old domain will be presented. > (sample rate was 3 times 30 connections) > > Clients sending SNI always get the right c...

We have the requirement to provide SSL on some IP addresses, but not others on our servers. Providing SSL is the easy part and we're able to use multiple SSL certificates now. (thanks Timo!) All is working ok, but we several IP hosts that do not require SSL and do not have valid certificates. While we can limit access via a firewall ACL to TLS connect ports (993/995) we can't do so on port 110/143. The problem is that some clients now are smart enoug...

I've installed LE certs on my Dovecot a while back, and, it has been working OK since, but, today, an iPhone user said he can't get emails as iphone says 'cert is expired', searching around, I see some other iPhone similar issues reported, do I have my conf correct, I have; # cat dovecot.conf | grep ssl ssl...

...tephan von Krawczynski <skraw at ithnet.com> wrote: > > On Fri, 18 Aug 2017 00:24:39 -0700 (PDT) > Joseph Tam <jtam.home at gmail.com> wrote: > >> Michael Felt <michael at felt.demon.nl> writes: >> >>>> I use acme.sh for all of my LetsEncrypt certs (web & mail), it is >>>> written in pure shell script, so no python dependencies. >>>> https://github.com/Neilpang/acme.sh >>> >>> Thanks - I might look at that, but as Ralph mentions in his reply - >>> Let's encrypt certs are only for...

Thanks Gabben and Andrew. I've understood but a new question emerged: Each DC server on my domain has a different pair cert/key and a different CA cert after deployment, correct? If so, is it a best practice to generate new cert for each DC server and sign them with a unique CA? OBS: Every DC servers belongs to the same domain. -- Igor Sousa Em dom., 14 de jun. de 2020 ?s 16:46, Andrew Bartlett <abartlet at samba...