Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have nice iRedMail server (postfix, dovecot, policyd). One of my client apps sends email via this server. And client want to sign it with digital signature on server side. Is it even possible to do what he wants?

share|improve this question
    
I have one more question ... what in your opinion is better doing this on mta server side or they should build code on aplications side that will be mailing already signed mails ? –  B14D3 Mar 29 '12 at 10:05

4 Answers 4

up vote 1 down vote accepted

It's possible, using an encryption gateway. Several products are available for Postifx. I've had some experience with Djigzo, works great.

share|improve this answer
1  
I would never store my personal certificate in Djigzo and trust someone to sign my emails. A private key is private by definition. Since emails to Djigzo are sent unsigned and unencrypted how can I be sure that only my (really sent from me) emails are signed? –  Matteo Mar 29 '12 at 8:51
    
True, it really depends on the circumstances which approach is best. The security of the private key depends on the security of the system it is stored on. Also, an encryption gateway can be used enforce an organization-wide encryption policy. –  J3L2404 Mar 29 '12 at 8:57
    
Ok if I understand it is possible but I have to install and configure another server with software do signing mails ? –  B14D3 Mar 29 '12 at 9:05
    
@B14D3 A separate server would be ideal, but you could also run an additional daemon on your mail server. –  J3L2404 Mar 29 '12 at 9:08

To sign an email you need the private key which should not be shared. If you distribute your private key (by putting it on a mail server) the mail agent would be able to use the key (has read access) to sign every email: bad idea.

A private key is private by definition and your client should sign his own email.

share|improve this answer

What you are asking for is called an S/MIME gateway and there are some add-ons to postfix to do exactly that.

This said, if all you need is a signed mail from a client application where the source code is controlled by you, you really should look into enabling S/MIME in your e-mail composition routines. As an example, the openssl command line utility has an smime mode allowing for signing, verifying, encrypting and decrypting S/MIME messages - you could simply insert an appropriately formed command into your mail sending routine.

share|improve this answer

Leaving aside the fact that the practice of signing on an MTA is rather dubious - checkout signing-milter (any MTA supporting milters) and anubis (an MTA proxy)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.