<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 16 June 2019 15:47 Marvin Gülker via dovecot <
<a href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a>> wrote:
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
Dear List,
</div>
<div>
<br>
</div>
<div>
I self-host my e-mail and run Dovecot since ever I do that. Dovecot
</div>
<div>
version is 2.3.4.1 (f79e8e7e4), running on Debian testing.
</div>
<div>
<br>
</div>
<div>
Now I am trying to configure Dovecot for client TLS certificates. I have
</div>
<div>
a self-signed certificate whose private key resides on a smartcard
</div>
<div>
(Yubikey, to be exact). I wanted Dovecot to accept that TLS client
</div>
<div>
certificate instead of a password. So I searched and found this wiki
</div>
<div>
page: <
<a href="https://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verification.2Fauthentication" rel="noopener" target="_blank">https://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verification.2Fauthentication</a>>
</div>
<div>
<br>
</div>
<div>
But that Wiki page says:
</div>
<div>
<br>
</div>
<blockquote type="cite">
<div>
The CA file should contain the certificate(s) followed by the matching
</div>
<div>
CRL(s). Note that the CRLs are required to exist.
</div>
</blockquote>
<div>
I have now messed three hours or so with OpenSSL to get a CRL generated
</div>
<div>
for my self-signed certificate, but I can't get that to work (the
</div>
<div>
problem appearently being that OpenSSL doesn't play well with private
</div>
<div>
keys on smartcards). It doesn't make sense anyway, why does one need a
</div>
<div>
CRL for a self-signed certificate? If the self-signed certificate's key
</div>
<div>
gets compromised, the CRL does not help at all.
</div>
<div>
<br>
</div>
<div>
So, here are my questions:
</div>
<div>
<br>
</div>
<div>
1. Is a CRL really a hard requirement?
</div>
<div>
2. If not: can I just use the self-signed certificate of my private key
</div>
<div>
for the ssl_ca setting?
</div>
<div>
3. If yes: any idea how I can generate a CRL for my smartcard-bound
</div>
<div>
self-signed certificate?
</div>
<div>
<br>
</div>
<div>
Marvin
</div>
<div>
<br>
</div>
<div>
--
</div>
<div>
Blog:
<a href="https://mg.guelker.eu" rel="noopener" target="_blank">https://mg.guelker.eu</a>
</div>
</blockquote>
<div>
<br>
</div>
<div>
You will save yourself from world of hurt if you use a dummy ca to sign you smartcard cert. You can try without generating a CRL.
</div>
<div>
<br>
</div>
<div>
To generate crl you need a functional ca config.
</div>
<div class="io-ox-signature">
<pre>---
Aki Tuomi</pre>
</div>
</body>
</html>