0

I have multiple domain on my mail server (postfix + dovecot) and I want to assign specific cerificate per domains.

Assuming to the dovecot documentation, I've tried this configuration :

local_name smtp.domain1.com {
  ssl_cert = </etc/ssl/certs/domain1.com-cert.pem
  ssl_key = </etc/ssl/private/domain1.com-privkey.key
  ssl_ca = </etc/ssl/certs/domain1.com-chain.pem
}

local_name smtp.domain2.com {
  ssl_cert = </etc/ssl/certs/smtp.domain2.com-cert.pem
  ssl_key = </etc/ssl/private/smtp.domain2.com-privkey.key
  ssl_ca = </etc/ssl/certs/smtp.domain2.com-chain.pem
}

But it doesn't work. This error is returned when I try to connect to the webmail (roundcube) :

Apr 22 22:36:06 localhost dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: ANY PRIVATE KEY
Apr 22 22:36:06 localhost dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs

When I try with openssl s_client :

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1524436845
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Without local_name (just 1 set of certificates), all works fine.

What's wrong with my configuration ?

  • Just look at your error: # Apr 22 22:36:06 localhost dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: ANY PRIVATE KEY Your file seems to be incorrect. – Marc Stürmer Apr 30 '18 at 9:27
0

I add to dovecot.conf the line :

!include /etc/dovecot/conf.d/*.conf

at the end & delete

ssl_cert = </path/to/cert.pem
ssl_key =</path/to/key.pem
ssl_protocols = !SSLv3 

(after uncomment same line in 10-ssl.conf)

and it's works now

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.