0

We are trying to get a dragonfly mta (dma) client to use STARTTLS with our mailhub. We created a self-signed certificate and key using openssl

openssl req -new -newkey rsa:4096 -x509 -sha256 -set_serial 201912200501 -days 3650 -nodes -out x.crt -keyout x.key

and concatenated these into a pem file:

cat x.crt x.key > /usr/local/etc/pki/tls/private/x.pem ; chmod 600 /usr/local/etc/pki/tls/private/x.pem

In /etc/dma.conf we have this:

SECURETRANSFER
STARTTLS
CERTFILE = /usr/local/etc/pki/tls/private/x.pem

When we try to send to the mail hub dma reports this in /var/log/maillog:

Dec 20 16:15:54 gway05 dma[2813d.8018280f0]: trying remote delivery to smtp.hamilton.harte-lyne.ca [216.185.71.31] pref 0
Dec 20 16:15:54 gway05 dma[2813d.8018280f0]: SSL: Cannot load certificate `= /usr/local/etc/pki/tls/private/x.pem': error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib
Dec 20 16:15:54 gway05 dma[2813d.8018280f0]: remote delivery deferred

What are we doing wrong?

  • Looking at the error message, it seems to be using the = as part of the pathname. Try: CERTFILE /usr/local/etc/pki/tls/private/x.pem – Richard Smith Dec 20 '19 at 21:36
  • Thanks. I made the change to dma.conf to remove the = but the problem remains: Dec 23 09:17:49 gway05 dma[28a88.8018280f0]: SSL: Cannot load certificate '/usr/local/etc/pki/tls/private/gway05_ss.pem': error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib. The = is gone from the error message but hat is about the only change. – James B. Byrne Dec 23 '19 at 14:20
  • The certificate that we are using is a self-signed openssl rsa generated using: openssl req -new -newkey rsa:4096 -x509 -sha256 -set_serial 201912200501 -days 3650 -nodes -out gway05_ss.crt -keyout gway05_ss.key Openssl verify shows exactly what we expect: openssl verify /usr/local/etc/pki/tls/private/gway05_ss.pem /usr/local/etc/pki/tls/private/gway05_ss.pem: C = CA, ST = Ontario, L = Hamilton, O = Harte & Lyne Limited, OU = IT, CN = gway05.hamilton.harte-lyne.ca, emailAddress = support@harte-lyne.ca error 18 at 0 depth lookup:self signed certificate OK – James B. Byrne Dec 23 '19 at 14:40
0

The problem with error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib is caused by the pem file not being readable by the wheel group. changing the permissions on /usr/local/etc/pki/tls/private/gway05_ss.pem to -rw-r----- 1 root wheel resolves the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.