Changes between Version 17 and Version 18 of Documentation/Community/HowTo/ZarafaSetupWithOutlookThunderbirdSync

Timestamp:

02/18/12 20:51:26 (16 months ago)

Author:

bbking (IP: 213.235.204.99)

Comment:

Better description of installing an official certificate for postfix

Documentation/Community/HowTo/ZarafaSetupWithOutlookThunderbirdSync

@@ -237 +237 @@
 Securing IMAP with an official certificate:[[BR]]
 
-1) put the certificate in the file /etc/postfix/sasl/smtpd.pem (Zentyal 2.0 or Ebox) or /etc/postfix/sasl/postfix.pem [[BR]]
-Create the .pem file according to above.[[BR]]
-2) restart the mail system with:[[BR]]
-{{{
-#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
-/etc/init.d/zentyal mail restart
+After my initial tests still did not satisfy Thunderbird, I've found a great tutorial on [http://www.howtoforge.com/securing-your-ispconfig-3-installation-with-a-free-class1-ssl-certificate-from-startssl]
+
+1) if you have a StarSSL certificate, get their CA files and give them speaking names:
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#555555"
+cd /home/youruser/[[BR]]
+wget !https://www.startssl.com/certs/ca.pem[[BR]]
+wget !https://www.startssl.com/certs/sub.class1.server.ca.pem[[BR]]
+mv ca.pem startssl.ca.crt[[BR]]
+mv sub.class1.server.ca.pem startssl.sub.class1.server.ca.crt[[BR]]
+}}}
+
+2) create the chain file
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#555555"
+cat startssl.sub.class1.server.ca.crt startssl.ca.crt > startssl.chain.class1.server.crt
+}}}
+
+At this point you have different options. Either you go with the official supported way and use the hooks for Zentyal, see [http://trac.zentyal.org/wiki/Documentation/Community/HowTo/CustomizeConfigFiles]
+
+or, if you want to do a quick hack, you can do it this way (keep in mind, after an update, these changes might be gone!!!):
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#555555"
+cd /usr/share/zentyal|ebox/stubs/mail[[BR]]
+cp main.cf.mas main.cf.mas<date>[[BR]]
+vi main.cf.mas[[BR]]
+}}}
+
+look for the lines with the entries
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+my $certFile = '/etc/postfix/sasl/postfix.pem';[[BR]]
+my $keyFile  = '/etc/postfix/sasl/postfix.pem';[[BR]]
+}}}
+
+and change them to:
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+my $certFile = '/etc/postfix/sasl/smtpd.crt';[[BR]]
+my $keyFile  = '/etc/postfix/sasl/smtpd.key';[[BR]]
+my $CAfile = '/etc/postfix/sasl/startssl.chain.class1.server.crt';[[BR]]
+}}}
+
+scroll down and look for the TLS/SSL stuff and add this line:
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+smtpd_tls_CAfile = <% $CAfile %>
+}}}
+
+save the file.
+
+Depending where you keep your official certificate and the key, please change the locations accordingly.
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#555555"
+cd /etc/postfix/sasl[[BR]]
+ln -s /home/youruser/www.snakeoil.com.crt smtpd.cert [[BR]]
+ln -s /home/youruser/www.snakeoil.com.key smtpd.key [[BR]]
+ln -s /home/youruser/startssl.chain.class1.server.crt startssl.chain.class1.server.crt [[BR]]
+}}}
+
+3) restart the mail system with:[[BR]]
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+/etc/init.d/zentyal mail restart[[BR]]
 }}}