SNI Config

[Aki Tuomi]

Hi!

The pipe syntax has never worked, no idea why you think it would have. Unfortunately at the moment, files are your best option. I do understand the annoyance.

Aki

> On 12/10/2022 13:54 EEST Paul Kudla (SCOM.CA Internet Services Inc.) <paul at scom.ca> wrote:
> 
>  
> ok thanks for your input
> 
> I finally tracked down the issue
> 
> It was how i was loading the certificates in the first place
> 
> that being said (and i must have missed this) 2.3.18 seems to allow 
> importing a cert from a program
> 
> thus sni config
> 
> local_name mail.paulkudla.net {
>    ssl_key =/programs/common/getssl.cert -k mail.paulkudla.net -q yes
>    ssl_cert =/programs/common/getssl.cert -r mail.paulkudla.net -q yes
>    ssl_ca =/programs/common/getssl.cert -i mail.paulkudla.net -q yes
> }
> 
> would work instead of file pipes from individual text files.
> 
> 
> #local_name mail.paulkudla.net {
> #  ssl_key =</usr/local/etc/dovecot/pk.key
> #  ssl_cert =</usr/local/etc/dovecot/pk.crt
> #  ssl_ca =</usr/local/etc/dovecot/pk.ca
> #}
> 
> 2.3.19 apparently no longer supports this?
> 
> aki is there a way to pipe the cert from a program file (as indicated above)
> 
> I am sure you can appreciate generating files for 1000+ ssl certs can 
> become a nightmare management wise
> 
> either that or a pgsql select ?
> 
> I have gone back to text files in the mean time ?
> 
> 
> 
> Happy Wednesday !!!
> Thanks - paul
> 
> Paul Kudla
> 
> 
> Scom.ca Internet Services <http://www.scom.ca>
> 004-1009 Byron Street South
> Whitby, Ontario - Canada
> L1N 4S3
> 
> Toronto 416.642.7266
> Main 1.866.411.7266
> Fax 1.888.892.7266
> Email paul at scom.ca
> 
> On 10/11/2022 12:46 PM, Jochen Bern wrote:
> > 
> > On 11.10.22 17:46, Paul Kudla (SCOM.CA Internet Services Inc.) wrote:
> >> ok according to
> >> https://www.openssl.org/docs/man1.0.2/man5/x509v3_config.html
> >> SAN is not a valid option along with CN
> > 
> > ... I don't see that being said in the page you refer to?
> > 
> > Anyhow, "stop giving a CN, use SANs instead" is a rather recent 
> > development coming from the CA/Browser Forum - and IIUC still not a 
> > *requirement*, not even for web browsers/servers. I would be surprised 
> > if OpenSSL (already) were trying to enforce that policy.
> > 
> > Hmmm, what's our company's "IMAPS server" throwing at my TB again ... ?
> > 
> >> $ openssl s_client -connect outlook.office365.com:993 -showcerts | 
> >> openssl x509 -noout -text
> > [...]
> >>         Subject: C = US, ST = Washington, L = Redmond, O = Microsoft 
> >> Corporation, CN = outlook.com
> > [...]
> >>             X509v3 Subject Alternative Name:                 
> >> DNS:*.clo.footprintdns.com, DNS:*.hotmail.com, 
> >> DNS:*.internal.outlook.com, [...]
> > 
> > ... yeah, no, nothing that Thunderbird (from 69-ish to 102) should get 
> > indigestion over.
> > 
> >> Upoin further testing thunderbird seems to be locking onto the primary 
> >> domain (*.scom.ca) of the server skipp any sni setup ??
> > 
> > You might want to get a network trace of your Thunderbird talking to the 
> > server to see what cert actually is presented by the server, and 
> > ideally, what domain is requested by SNI (if at all). That all happens 
> > before the connection starts to be encrypted, so you should be able to 
> > read it (say, with Wireshark) without having to crack any crypto ...
> > 
> > Kind regards,