EDIT: AS the following documents describes http://www.novell.com/support/kb/doc.php?id=7002392 i've concatenated those files like this domain.crt sf_bundle.crt >> domain.pem and now the following command openssl s_client -connect domain:465 complains about verify error:num=19:self signed certificate in certificate chain I Hope someone can help to geo out a clue :D

i've just configured our mta through postfix which offers IMAP and SMTP through TLS. During testing i created a self signed certificate but now, to avoid the annoying untrusted certificate warning i bought a cheap certificate at Godaddy; http://www.godaddy.com/compare/gdcompare3_ssl.aspx

The issue here is i'm doing something wrong, probably when installing the Godaddy downloaded certificate, so i'm still seing the warning.

Following is the process i've run into:

openssl genrsa -des3 -out domain.key 1024
openssl req -new -key domain.key -out domain.csr

Went to Godaddy, paste the content of the csr file including being and ending tags. At that point i was able to download the generated certificate, which was a zip file, so now i have the following files:

sf_bundle.crt ;Chain file, on't know how should be used
domain.crt ;Provided along with sf_bundle by Godaddy
domain.csr ;Genrated by me
domain.key ;Genrated by me

I'm not sure how i should proceed but i did the following:

cat domain.crt sf_bundle.crt >> /etc/ssl/certs/domain.pem
ln -sf /path/to/domain.key /etc/ssl/private/domain.key  

But when testing i get the following issue:

    openssl s_client -connect imap.domain.ltd:465
depth=2 C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority
verify error:num=19:self signed certificate in certificate chain
verify return:0
Certificate chain
 0 s:/OU=Domain Control Validated/CN=webeloping.es
   i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certificates.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/serialNumber=10688435
 1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certificates.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/serialNumber=10688435
   i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
 2 s:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
   i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
Server certificate

Related configuration in postfix looks like this:

    ## /etc/postfix/main.cf
    ##Provided by Godaddy along with sf_bundle.crt
    ##Generated by me
  • I believe that novell documentation is decidedly incorrect about including the key in the file being used as the cert (in this situation). Some servers use split cert and key file locations and some use a combined file. postfix seems to use the split form so combining the key and the cert is just likely to cause you to accidentally leak your key (when you forget it is in the concatenated pem file). – Etan Reisner Jul 12 '13 at 16:48

You don't need the root certificate in the chain (though I don't believe having it hurts anything).

That error is more of a warning from openssl in this case I think. I believe what it means is just that openssl doesn't know that it should trust the root certificate of that chain. If you pull out just the root certificate from that bundle and point that openssl command at it with the -CAfile argument I expect that "error" should go away.

Inside the sf_bundle.crt file you should see two


blocks (possibly with plain text above each block showing what certificate the block contains). If you split each of those blocks into its own file so you end up with block1.crt and block2.crt you should be able to run openssl x509 -noout -subject -in <file.crt> on each of them to get their respective certificate subject lines.

Assuming that block2.crt has a subject line of /C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority you should then be able to run openssl s_client -CAfile block2.crt -connect imap.domain.ltd:465 and that should, hopefully, connect without giving you the self-signed certificate error.

  • Thanks for the quick reply Etan, how should i proceed to pull out the root certificate? Do you mean i should just use sf_bundle.crt? – peris Jul 12 '13 at 13:57
  • If you look in sf_bundle.crt you should see two certificate blocks (possibly with plain text certificate information "headers"). If you copy the block that represents the root certificate into its own file you can use if with -CAfile as I said and that should make the error go away. If you can't tell which block is which then split them both out and then you can use openssl x509 -text -noout -in <file> | less to find out which file is which. – Etan Reisner Jul 12 '13 at 14:05
  • Thanks a lot for your patience and explanations, which i'm reading carefully but i don't seem to understand. Right now Postfix is configured like this:smtpd_tls_cert_file=/etc/ssl/certs/domain.crt smtpd_tls_key_file=/etc/ssl/private/domain.key The key file was generated by me and the crt is the one provided by Godaddy, if i split sf_bundle into two files and use any oen of them - no matter which one as i've tried both - i get the following error write:errno=104 --- no peer certificate available – peris Jul 12 '13 at 15:51
  • I didn't suggest using that in place of domain.crt in the postfix config. I suggested using the split out piece in the openssl command you were using to test your postfix configuration. – Etan Reisner Jul 12 '13 at 15:54
  • Etan, but first sten shouldn't be to get Postfix configuration pointing the right files? Right now, which file should point smtpd_tls_cert_file statement? Thanks, – peris Jul 12 '13 at 16:05

If you really did

domain.key domain.crt sf_bundle.crt >> domain.pem

then you included your private key in the chain, which you should not.

Only your server's certificate plus the chain of intermediary certificates are needed, so that the client can match the issuer of the top of them to a trusted root certificate he possesses

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.