Subject: UW imapd and InstantSSL certs

From: Kai Lanz <[email-masked]>
Date: Thu, 1 Jul 2004 16:54:27 -0700 (PDT)

We currently run imapd-2002e and support SSL authentication using
a certificate from Verisign.  That cert is about to expire, and we're
replacing it with certs from InstantSSL (much much cheaper).

It was easy to prepare the Verisign certs for use with imapd -- just
concatenate the server private key and the host certificate into
a file called imapd.pem and stick that in /local/ssl/certs/:

    cat server.key pangea.crt > imapd.pem

InstantSSL gives us *two* certificates: a host certificate and a CA
certificate, i.e. a Comodo intermediate certificate.  Can the UW imapd
work with this certificate-plus-intermediate configuration?  What do 
I need to do to prepare our new imapd.pem?

-- Kai Lanz      [email-masked]

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Thu, 1 Jul 2004 17:03:58 -0700 (PDT)

> I need to do to prepare our new imapd.pem?

I don't know enough about this to give a guaranteed answer.  Hey, I just 
wrote the code, what makes anyone thing I know anything! :-)

But anyway, it sounds to me that your host certificate is what would 
become your imapd.pem (and is a private key for imapd).

Separately, you want to install the CA certificate, including making the 
funny symlink via
  ln -s Comodo.pem `/usr/local/ssl/bin/openssl x509 -noout -hash < Comodo.pem`.0
(substitute the CA certificate's file name for "Comodo.pem") which will 
make a symlink with an 8-digit hex value and an extension of .0 that 
points to the CA certificate's PEM file

The CA certificate is for Pine to be able to validate what IMAP offers; so 
the CA certificate should be publicly-readable and the imapd.pem should be 
read-protected.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: [email-masked] (Jim Seymour)
Date: Thu, 1 Jul 2004 20:57:00 -0400 (EDT)

Kai Lanz <[email-masked]> wrote:
[snip]
> I need to do to prepare our new imapd.pem?

Luckily (for you) I just went through this.  (UW IMAP's pop3d and
Postfix SMTP-AUTH/TLS/STARTTLS)

There will be four components to what you'll have to put in imapd.pem,
when using InstantSSL/Comodo certs:

   Server private key
   Your server cert.
   N-year Comodo intermediate cert.
   GTE N-year root (?) cert.

I don't know if the order's important, but that's the order I put them
in.

Hope this helped.

(Btw: I've been quite pleased with InstantSSL.)

Jim