<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<p>Thanks Nikolai,</p>
<p>So far, I have concluded that the Dovecot distribution seems to
be ready to be deployed with essentially no modification of
configuration files.<br>
</p>
<p>I am using CentOS 7 and sendmail.</p>
<p>Raymond<br>
</p>
<p><br>
</p>
On 11/10/2020 1:58 AM, Nikolai Lusan wrote:<br>
<blockquote type="cite">On Tue, 2020-11-10 at 00:26 -0600, Raymond
Herrera wrote:<br>
> Good. I am going to focus on the IMAP configuration and worry
about<br>
> SMTP<br>
> later.<br>
<br>
Yeah, also the postfix list is probably more useful for the SMTP
stuff,<br>
although having said that the two products integrate seemlessly.<br>
<br>
> The following is the relevant documentation.<br>
> This is very straightforward:<br>
>
<a class="moz-txt-link-freetext" href="https://doc.dovecot.org/admin_manual/ssl/dovecot_configuration/">https://doc.dovecot.org/admin_manual/ssl/dovecot_configuration/</a><br>
<br>
> My file 10-ssl.conf is untouched.<br>
<br>
> However, this is the part that I would like to better
understand:<br>
<br>
>
<a class="moz-txt-link-freetext" href="https://doc.dovecot.org/admin_manual/ssl/certificate_creation/">https://doc.dovecot.org/admin_manual/ssl/certificate_creation/</a><br>
<br>
> Before creating my own certificate (which I have done in the
past for<br>
> my<br>
> old server), I am curious. Is there anything wrong with the
one that<br>
> comes with the distribution?<br>
<br>
The certificate which comes with either dovecot, or your
distribution<br>
(in Debian it's "/etc/ssl/certs/ssl-cert-snakeoil.pem") is a self<br>
signed certificate, which most clients will force you to accept<br>
(permanently, or temporarily). Personally I am using Lets Encrypt
(<br>
<a class="moz-txt-link-freetext" href="https://letsencrypt.org/">https://letsencrypt.org/</a>) wildcard certificates (since I am not
just<br>
using them for email purposes), and I have scripts that restart
the<br>
relevant services when the certificates get updated (LE cert are
only<br>
valid for 90 days, and can be renewed at 60 days). Look into LE
and the<br>
tools available for Linux, pick the one that works for you, I use<br>
acme.sh which I find easier to script around.<br>
<br>
> ssl_cert = < /etc/pki/dovecot/certs/dovecot.pem<br>
> ssl_key = < /etc/pki/dovecot/private/dovecot.pem<br>
<br>
So this is a public/private key pair. Just like for ssh, gpg, or
many<br>
other cryptography related tools. The ssl_cert line is the public<br>
certificate, and the ssl_key line is the key used to create the
sign<br>
the initial certificate request (the CRL is later signed by an
issuer,<br>
in the case of the snakeoil certs this is seperate private key).<br>
<br>
<br>
</blockquote>
<br>
</body>
</html>