elmau
/
iredmail-doc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Rename ssl cert/key/ca file names for better understanding with LetsEncrypt.

This commit is contained in:
Zhang Huangbin 2017-10-13 08:53:42 +08:00
parent cca66fdb10
commit 7d867d25e2
2 changed files with 58 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
en_US/howto/use.a.bought.ssl.certificate.md
View File

@ -34,12 +34,12 @@ key and signing request file on your server with `openssl` command:
Do NOT use key length smaller than `2048` bit, it's insecure. Do NOT use key length smaller than `2048` bit, it's insecure.
``` ```
# openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # openssl req -new -newkey rsa:2048 -nodes -keyout privkey.pem -out server.csr
``` ```
This command will generate two files: This command will generate two files:
* `server.key`: the private key for the decryption of your SSL certificate. * `privkey.pem`: the private key for the decryption of your SSL certificate.
* `server.csr`: the certificate signing request (CSR) file used to apply * `server.csr`: the certificate signing request (CSR) file used to apply
for your SSL certificate. __This file is required by SSL certificate for your SSL certificate. __This file is required by SSL certificate
provider.__ provider.__
@ -66,22 +66,22 @@ specified during enrollment. For example, a certificate for the domain
or `secure.domain.com`, because `www.domain.com` and `secure.domain.com` are or `secure.domain.com`, because `www.domain.com` and `secure.domain.com` are
different from `domain.com`. different from `domain.com`.
Now you have two files: `server.key` and `server.csr`. Go to the website of Now you have two files: `privkey.pem` and `server.csr`. Go to the website of
your preferred SSL privider, it will ask you to upload `server.csr` file to your preferred SSL privider, it will ask you to upload `server.csr` file to
issue an SSL certificate. issue an SSL certificate.
Usually, SSL provider will give you 2 files: Usually, SSL provider will give you 2 files:
* server.crt * cert.pem
* server.ca-bundle * fullchain.pem (some SSL providers use name `server.ca-bundle`)
We need above 2 files, and `server.key`. Upload them to your server, you can We need above 2 files, and `privkey.pem`. Upload them to your server, you can
store them in any directory you like, recommended directories are: store them in any directory you like, recommended directories are:
* on RHEL/CentOS: `server.crt` and `server.ca-bundle` should be placed under * on RHEL/CentOS: `cert.pem` and `fullchain.pem` should be placed under
`/etc/pki/tls/certs/`, `server.key` should be `/etc/pki/tls/private/`. `/etc/pki/tls/certs/`, `privkey.pem` should be `/etc/pki/tls/private/`.
* on Debian/Ubuntu, FreeBSD: `server.crt` and `server.ca-bundle` should be * on Debian/Ubuntu, FreeBSD: `cert.pem` and `fullchain.pem` should be
placed under `/etc/ssl/certs/`, `server.key` should be `/etc/ssl/private/`. placed under `/etc/ssl/certs/`, `privkey.pem` should be `/etc/ssl/private/`.
* on OpenBSD: `/etc/ssl/`. * on OpenBSD: `/etc/ssl/`.
## Configure Postfix/Dovecot/Apache/Nginx to use bought SSL certificate ## Configure Postfix/Dovecot/Apache/Nginx to use bought SSL certificate
@ -93,9 +93,9 @@ one on your server according to above description.
We can use `postconf` command to update SSL related settings directly: We can use `postconf` command to update SSL related settings directly:
``` ```
postconf -e smtpd_tls_cert_file='/etc/pki/tls/certs/server.crt' postconf -e smtpd_tls_cert_file='/etc/pki/tls/certs/cert.pem'
postconf -e smtpd_tls_key_file='/etc/pki/tls/private/server.key' postconf -e smtpd_tls_key_file='/etc/pki/tls/private/privkey.pem'
postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/server.ca-bundle' postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/fullchain.pem'
``` ```
Restarting Postfix service is required. Restarting Postfix service is required.
@ -108,9 +108,9 @@ SSL certificate settings are defined in Dovecot main config file,
``` ```
ssl = required ssl = required
ssl_cert = </etc/pki/tls/certs/server.crt ssl_cert = </etc/pki/tls/certs/cert.pem
ssl_key = </etc/pki/tls/private/server.key ssl_key = </etc/pki/tls/private/privkey.pem
ssl_ca = </etc/pki/tls/certs/server.ca-bundle ssl_ca = </etc/pki/tls/certs/fullchain.pem
``` ```
Restarting Dovecot service is required. Restarting Dovecot service is required.
@ -130,9 +130,9 @@ Restarting Dovecot service is required.
Example: Example:
``` ```
SSLCertificateFile /etc/pki/tls/certs/server.crt SSLCertificateFile /etc/pki/tls/certs/cert.pem
SSLCertificateKeyFile /etc/pki/tls/private/server.key SSLCertificateKeyFile /etc/pki/tls/private/privkey.pem
SSLCertificateChainFile /etc/pki/tls/certs/server.ca-bundle SSLCertificateChainFile /etc/pki/tls/certs/fullchain.pem
``` ```
Restarting Apache service is required. Restarting Apache service is required.
@ -147,8 +147,8 @@ server {
listen 443; listen 443;
... ...
ssl on; ssl on;
ssl_certificate /etc/pki/tls/certs/server.crt; ssl_certificate /etc/pki/tls/certs/cert.pem;
ssl_certificate_key /etc/pki/tls/private/server.key; ssl_certificate_key /etc/pki/tls/private/privkey.pem;
... ...
} }
``` ```
@ -165,7 +165,7 @@ certificates in the combined file:
``` ```
# cd /etc/pki/tls/certs/ # cd /etc/pki/tls/certs/
# cat server.crt server.ca-bundle > server.chained.crt # cat cert.pem fullchain.pem > server.chained.crt
``` ```
Then update `ssl_certificate` parameter in `/etc/nginx/conf.d/default.conf`: Then update `ssl_certificate` parameter in `/etc/nginx/conf.d/default.conf`:
@ -189,9 +189,9 @@ Restarting Nginx service is required.
``` ```
[mysqld] [mysqld]
ssl-ca = /etc/pki/tls/certs/server.ca-bundle ssl-ca = /etc/pki/tls/certs/fullchain.pem
ssl-cert = /etc/pki/tls/certs/server.crt ssl-cert = /etc/pki/tls/certs/cert.pem
ssl-key = /etc/pki/tls/private/server.key ssl-key = /etc/pki/tls/private/privkey.pem
``` ```
### OpenLDAP ### OpenLDAP
@ -205,9 +205,9 @@ ssl-key = /etc/pki/tls/private/server.key
* On OpenBSD, it's defined in `/etc/openldap/slapd.conf`. * On OpenBSD, it's defined in `/etc/openldap/slapd.conf`.
``` ```
TLSCACertificateFile /etc/pki/tls/certs/server.ca-bundle TLSCACertificateFile /etc/pki/tls/certs/fullchain.pem
TLSCertificateFile /etc/pki/tls/certs/server.crt TLSCertificateFile /etc/pki/tls/certs/cert.pem
TLSCertificateKeyFile /etc/pki/tls/private/server.key TLSCertificateKeyFile /etc/pki/tls/private/privkey.pem
``` ```
Restarting OpenLDAP service is required. Restarting OpenLDAP service is required.
@ -223,7 +223,7 @@ error message like `Peer's Certificate issuer is not recognized`.
* On OpenBSD, it's defined in `/etc/openldap/ldap.conf`. * On OpenBSD, it's defined in `/etc/openldap/ldap.conf`.
``` ```
TLS_CACERT /etc/pki/tls/certs/server.ca-bundle TLS_CACERT /etc/pki/tls/certs/fullchain.pem
``` ```
To connect with TLS, please run `ldapsearch` with argument `-Z` and use To connect with TLS, please run `ldapsearch` with argument `-Z` and use

58
html/use.a.bought.ssl.certificate.html
View File

@ -68,12 +68,12 @@ key and signing request file on your server with <code>openssl</code> command:</
<p class="admonition-title">Warning</p> <p class="admonition-title">Warning</p>
<p>Do NOT use key length smaller than <code>2048</code> bit, it's insecure.</p> <p>Do NOT use key length smaller than <code>2048</code> bit, it's insecure.</p>
</div> </div>
<pre><code># openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr <pre><code># openssl req -new -newkey rsa:2048 -nodes -keyout privkey.pem -out server.csr
</code></pre> </code></pre>
<p>This command will generate two files:</p> <p>This command will generate two files:</p>
<ul> <ul>
<li><code>server.key</code>: the private key for the decryption of your SSL certificate.</li> <li><code>privkey.pem</code>: the private key for the decryption of your SSL certificate.</li>
<li><code>server.csr</code>: the certificate signing request (CSR) file used to apply <li><code>server.csr</code>: the certificate signing request (CSR) file used to apply
for your SSL certificate. <strong>This file is required by SSL certificate for your SSL certificate. <strong>This file is required by SSL certificate
provider.</strong></li> provider.</strong></li>
@ -99,21 +99,21 @@ specified during enrollment. For example, a certificate for the domain
<code>domain.com</code> will receive a warning if accessing a site named <code>www.domain.com</code> <code>domain.com</code> will receive a warning if accessing a site named <code>www.domain.com</code>
or <code>secure.domain.com</code>, because <code>www.domain.com</code> and <code>secure.domain.com</code> are or <code>secure.domain.com</code>, because <code>www.domain.com</code> and <code>secure.domain.com</code> are
different from <code>domain.com</code>.</p> different from <code>domain.com</code>.</p>
<p>Now you have two files: <code>server.key</code> and <code>server.csr</code>. Go to the website of <p>Now you have two files: <code>privkey.pem</code> and <code>server.csr</code>. Go to the website of
your preferred SSL privider, it will ask you to upload <code>server.csr</code> file to your preferred SSL privider, it will ask you to upload <code>server.csr</code> file to
issue an SSL certificate.</p> issue an SSL certificate.</p>
<p>Usually, SSL provider will give you 2 files:</p> <p>Usually, SSL provider will give you 2 files:</p>
<ul> <ul>
<li>server.crt</li> <li>cert.pem</li>
<li>server.ca-bundle</li> <li>fullchain.pem (some SSL providers use name <code>server.ca-bundle</code>)</li>
</ul> </ul>
<p>We need above 2 files, and <code>server.key</code>. Upload them to your server, you can <p>We need above 2 files, and <code>privkey.pem</code>. Upload them to your server, you can
store them in any directory you like, recommended directories are:</p> store them in any directory you like, recommended directories are:</p>
<ul> <ul>
<li>on RHEL/CentOS: <code>server.crt</code> and <code>server.ca-bundle</code> should be placed under <li>on RHEL/CentOS: <code>cert.pem</code> and <code>fullchain.pem</code> should be placed under
<code>/etc/pki/tls/certs/</code>, <code>server.key</code> should be <code>/etc/pki/tls/private/</code>.</li> <code>/etc/pki/tls/certs/</code>, <code>privkey.pem</code> should be <code>/etc/pki/tls/private/</code>.</li>
<li>on Debian/Ubuntu, FreeBSD: <code>server.crt</code> and <code>server.ca-bundle</code> should be <li>on Debian/Ubuntu, FreeBSD: <code>cert.pem</code> and <code>fullchain.pem</code> should be
placed under <code>/etc/ssl/certs/</code>, <code>server.key</code> should be <code>/etc/ssl/private/</code>.</li> placed under <code>/etc/ssl/certs/</code>, <code>privkey.pem</code> should be <code>/etc/ssl/private/</code>.</li>
<li>on OpenBSD: <code>/etc/ssl/</code>.</li> <li>on OpenBSD: <code>/etc/ssl/</code>.</li>
</ul> </ul>
<h2 id="configure-postfixdovecotapachenginx-to-use-bought-ssl-certificate">Configure Postfix/Dovecot/Apache/Nginx to use bought SSL certificate</h2> <h2 id="configure-postfixdovecotapachenginx-to-use-bought-ssl-certificate">Configure Postfix/Dovecot/Apache/Nginx to use bought SSL certificate</h2>
@ -121,9 +121,9 @@ store them in any directory you like, recommended directories are:</p>
one on your server according to above description.</p> one on your server according to above description.</p>
<h3 id="postfix-smtp-server">Postfix (SMTP server)</h3> <h3 id="postfix-smtp-server">Postfix (SMTP server)</h3>
<p>We can use <code>postconf</code> command to update SSL related settings directly:</p> <p>We can use <code>postconf</code> command to update SSL related settings directly:</p>
<pre><code>postconf -e smtpd_tls_cert_file='/etc/pki/tls/certs/server.crt' <pre><code>postconf -e smtpd_tls_cert_file='/etc/pki/tls/certs/cert.pem'
postconf -e smtpd_tls_key_file='/etc/pki/tls/private/server.key' postconf -e smtpd_tls_key_file='/etc/pki/tls/private/privkey.pem'
postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/server.ca-bundle' postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/fullchain.pem'
</code></pre> </code></pre>
<p>Restarting Postfix service is required.</p> <p>Restarting Postfix service is required.</p>
@ -132,9 +132,9 @@ postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/server.ca-bundle'
<code>/etc/dovecot/dovecot.conf</code> (Linux/OpenBSD) or <code>/etc/dovecot/dovecot.conf</code> (Linux/OpenBSD) or
<code>/usr/local/etc/dovecot/dovecot.conf</code> (FreeBSD):</p> <code>/usr/local/etc/dovecot/dovecot.conf</code> (FreeBSD):</p>
<pre><code>ssl = required <pre><code>ssl = required
ssl_cert = &lt;/etc/pki/tls/certs/server.crt ssl_cert = &lt;/etc/pki/tls/certs/cert.pem
ssl_key = &lt;/etc/pki/tls/private/server.key ssl_key = &lt;/etc/pki/tls/private/privkey.pem
ssl_ca = &lt;/etc/pki/tls/certs/server.ca-bundle ssl_ca = &lt;/etc/pki/tls/certs/fullchain.pem
</code></pre> </code></pre>
<p>Restarting Dovecot service is required.</p> <p>Restarting Dovecot service is required.</p>
@ -151,9 +151,9 @@ ssl_ca = &lt;/etc/pki/tls/certs/server.ca-bundle
ship Apache anymore.</li> ship Apache anymore.</li>
</ul> </ul>
<p>Example:</p> <p>Example:</p>
<pre><code>SSLCertificateFile /etc/pki/tls/certs/server.crt <pre><code>SSLCertificateFile /etc/pki/tls/certs/cert.pem
SSLCertificateKeyFile /etc/pki/tls/private/server.key SSLCertificateKeyFile /etc/pki/tls/private/privkey.pem
SSLCertificateChainFile /etc/pki/tls/certs/server.ca-bundle SSLCertificateChainFile /etc/pki/tls/certs/fullchain.pem
</code></pre> </code></pre>
<p>Restarting Apache service is required.</p> <p>Restarting Apache service is required.</p>
@ -166,8 +166,8 @@ SSLCertificateChainFile /etc/pki/tls/certs/server.ca-bundle
listen 443; listen 443;
... ...
ssl on; ssl on;
ssl_certificate /etc/pki/tls/certs/server.crt; ssl_certificate /etc/pki/tls/certs/cert.pem;
ssl_certificate_key /etc/pki/tls/private/server.key; ssl_certificate_key /etc/pki/tls/private/privkey.pem;
... ...
} }
</code></pre> </code></pre>
@ -182,7 +182,7 @@ bundle of chained certificates which should be concatenated to the signed
server certificate. The server certificate must appear before the chained server certificate. The server certificate must appear before the chained
certificates in the combined file:</p> certificates in the combined file:</p>
<pre><code># cd /etc/pki/tls/certs/ <pre><code># cd /etc/pki/tls/certs/
# cat server.crt server.ca-bundle &gt; server.chained.crt # cat cert.pem fullchain.pem &gt; server.chained.crt
</code></pre> </code></pre>
<p>Then update <code>ssl_certificate</code> parameter in <code>/etc/nginx/conf.d/default.conf</code>:</p> <p>Then update <code>ssl_certificate</code> parameter in <code>/etc/nginx/conf.d/default.conf</code>:</p>
@ -206,9 +206,9 @@ network, this is OPTIONAL.</p>
</ul> </ul>
<pre><code>[mysqld] <pre><code>[mysqld]
ssl-ca = /etc/pki/tls/certs/server.ca-bundle ssl-ca = /etc/pki/tls/certs/fullchain.pem
ssl-cert = /etc/pki/tls/certs/server.crt ssl-cert = /etc/pki/tls/certs/cert.pem
ssl-key = /etc/pki/tls/private/server.key ssl-key = /etc/pki/tls/private/privkey.pem
</code></pre> </code></pre>
<h3 id="openldap">OpenLDAP</h3> <h3 id="openldap">OpenLDAP</h3>
@ -222,9 +222,9 @@ network, this is OPTIONAL.</p>
<li>On FreeBSD, it's defined in <code>/usr/local/etc/openldap/slapd.conf</code>.</li> <li>On FreeBSD, it's defined in <code>/usr/local/etc/openldap/slapd.conf</code>.</li>
<li>On OpenBSD, it's defined in <code>/etc/openldap/slapd.conf</code>.</li> <li>On OpenBSD, it's defined in <code>/etc/openldap/slapd.conf</code>.</li>
</ul> </ul>
<pre><code>TLSCACertificateFile /etc/pki/tls/certs/server.ca-bundle <pre><code>TLSCACertificateFile /etc/pki/tls/certs/fullchain.pem
TLSCertificateFile /etc/pki/tls/certs/server.crt TLSCertificateFile /etc/pki/tls/certs/cert.pem
TLSCertificateKeyFile /etc/pki/tls/private/server.key TLSCertificateKeyFile /etc/pki/tls/private/privkey.pem
</code></pre> </code></pre>
<p>Restarting OpenLDAP service is required.</p> <p>Restarting OpenLDAP service is required.</p>
@ -238,7 +238,7 @@ error message like <code>Peer's Certificate issuer is not recognized</code>.</p>
<li>On FreeBSD, it's defined in <code>/usr/local/etc/openldap/ldap.conf</code>.</li> <li>On FreeBSD, it's defined in <code>/usr/local/etc/openldap/ldap.conf</code>.</li>
<li>On OpenBSD, it's defined in <code>/etc/openldap/ldap.conf</code>.</li> <li>On OpenBSD, it's defined in <code>/etc/openldap/ldap.conf</code>.</li>
</ul> </ul>
<pre><code>TLS_CACERT /etc/pki/tls/certs/server.ca-bundle <pre><code>TLS_CACERT /etc/pki/tls/certs/fullchain.pem
</code></pre> </code></pre>
<p>To connect with TLS, please run <code>ldapsearch</code> with argument <code>-Z</code> and use <p>To connect with TLS, please run <code>ldapsearch</code> with argument <code>-Z</code> and use