<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 05/08/2014 11:22 PM, Godwin wrote:<br>
</div>
<blockquote
cite="mid:CAO0okVwwgnA78irqN6Gm_G-e9rHTFDWAW1Rsasn8GGGnEpAr8Q@mail.gmail.com"
type="cite">
<div dir="ltr">Hi Patrick,
<div><br>
</div>
<div>Yes, Godaddy's certificate will work on Apache, Postfix,
Cyrus IMAP (or anything else that requires a cert - I
suspect). This site has quick reference to common OpenSSL
command like generating a key, csr, cert, etc.</div>
<div><br>
</div>
<div><a moz-do-not-send="true"
href="http://www.sslshopper.com/article-most-common-openssl-commands.html">http://www.sslshopper.com/article-most-common-openssl-commands.html</a><br>
</div>
<div><br>
</div>
<div>To add your cert to Postfix, you'll need the key you
generated (prior to the CSR you generated), and both the
domain cert and CA cert you got from Godaddy. Here's how to
use them in Postfix's "<font face="courier new, monospace"><b><a
moz-do-not-send="true" href="http://main.cf">main.cf</a></b></font>"
file:</div>
<div><br>
</div>
<div>
<div><font color="#0000ff" face="courier new, monospace">smtp_use_tls
= yes</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtp_tls_note_starttls_offer
= yes</font></div>
<div><font face="courier new, monospace"><font color="#38761d">#
The two lines above allows us to ask for TLS on
connecting to other servers.</font><br>
</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_use_tls
= yes</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_auth_only
= no</font></div>
<div>
<div><font color="#38761d" face="courier new, monospace">#
Use this to force TLS (problem is, then no TLS sessions
will be rejected)</font></div>
<div><font color="#38761d" face="courier new, monospace">#smtpd_tls_security_level
= encrypt</font></div>
</div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_cert_file
= /etc/postfix/ssl/yourdomain.com-cert.crt</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_key_file
= /etc/postfix/ssl/yourdomain.com.key</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_CAfile
= /etc/postfix/ssl/gd_bundle-g2-g1.crt</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_loglevel
= 3</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_received_header
= yes</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_session_cache_timeout
= 3600s</font></div>
<div><font color="#0000ff" face="courier new, monospace">tls_random_source
= dev:/dev/urandom</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtpd_tls_session_cache_database
= btree:${data_directory}/smtpd_scache</font></div>
<div><font color="#0000ff" face="courier new, monospace">smtp_tls_session_cache_database
= btree:${data_directory}/smtp_scache</font></div>
</div>
<div>
<div><font color="#38761d" face="courier new, monospace"># See
/usr/share/doc/postfix/TLS_README.gz in the postfix-doc
package for</font></div>
<div><font color="#38761d" face="courier new, monospace">#
information on enabling SSL in the smtp client.</font></div>
</div>
<div><br>
</div>
<div>Others can scrutinize this, but that's the gist of if.</div>
<div><br>
</div>
<div>cheers,</div>
<div>Godwin</div>
<div><br>
</div>
<div><br>
</div>
</div>
</blockquote>
Thank you for the help. I have made the changes as noted and the
"telnet" test show tls starting.<br>
<br>
I can access the email account using thunderbird on port 110, pop3.<br>
<br>
Now I am trying to set up thunderbird to use port 995, pop3 / ssl /
tls<br>
<br>
I have courier on the mail server.<br>
<br>
When I try to connect with thunderbird I get the following error on
the mail server:<br>
<br>
pop3d-ssl: couriertls: /etc/courier/pop3d.pem: error:0906D06C:PEM
routines:PEM_read_bio:no start line<br>
<br>
Doing web searches I find references to .pem and .der certifiacates.<br>
<br>
I did a openssl x509 -in mycertifiacte.crt -text -noout and it shows
the certificate text without error.<br>
<br>
So what do I do now?<br>
<br>
Patrick<br>
<br>
<br>
<u></u><br>
<br>
</body>
</html>