Subject: SSL build instructions for imap-2000

From: Mark Crispin <[email-masked]>
Date: Mon, 5 Jun 2000 18:02:33 -0700 (PDT)

The following document will be in the next imap-2000 tarball.  I'm issuing
it now, in the hope that it may be useful to folks who've been scratching
their heads about what to do.

-- Mark --

* RCW 19.190 notice: This email address is located in Washington State.	*
* Unsolicited commercial email may be billed $500 per message.		*
Science does not emerge from voting, party politics, or public debate.

		  SSL BUILD AND INSTALLATION NOTES FOR UNIX

     Before doing an SSL build, you should read imap-2000/docs/BUILD to make
sure that you understand how to do a non-SSL build.

     To start, you need to have some version of OpenSSL (or perhaps SSLeay; I
don't know if it'll still build with SSLeay) properly installed on the
standard /usr/local/ssl directory.  In particular, /usr/local/ssl/include
(and /usr/local/ssl/include/openssl) and /usr/local/ssl/lib must be set up
from the OpenSSL build.

     OpenSSL is available from third parties.  We do not provide OpenSSL.

     To build with SSL, add "SPECIALAUTHENTICATORS=ssl" to the make command
line.  For example, on Red Hat Linux, the appropriate command would be:
	make lnp SPECIALAUTHENTICATORS=ssl

     There are other make options, described in imap-2000/src/osdep/Makefile.

     Binaries from the build are:
	imap-2000/mtest/mtest		c-client testbed program
	imap-2000/ipopd/ipop2d		POP2 daemon
	imap-2000/ipopd/ipop3d		POP3 daemon
	imap-2000/imapd/imapd		IMAP4rev1 daemon

     mtest is normally not used except by c-client developers.

STEP 1:	inetd setup

     The ipop2d, ipop3d, and imapd daemons should be installed in a system
daemon directory (in the following examples, /usr/local/etc is used), and
invoked by your /etc/inetd.conf file with lines such as:

pop	stream	tcp	nowait	root	/usr/local/etc/ipop2d	ipop2d
pop3	stream	tcp	nowait	root	/usr/local/etc/ipop3d	ipop3d
imap	stream	tcp	nowait	root	/usr/local/etc/imapd	imapd
pop3s	stream	tcp	nowait	root	/usr/local/etc/ipop3d	ipop3d
imaps	stream	tcp	nowait	root	/usr/local/etc/imapd	imapd

     Please refer to imap-2000/docs/BUILD for an important note about inetd's
limit on the number of new connections.  If that note applies to you, and you
can configure the number of connection in /etc/inetd.conf as described in
imap-2000/docs/build, here is the sample /etc/inetd.conf entry with SSL:

pop3	stream	tcp	nowait.100	root	/usr/local/etc/ipop3d	ipop3d
pop3s	stream	tcp	nowait.100	root	/usr/local/etc/ipop3d	ipop3d
imap	stream	tcp	nowait.100	root	/usr/local/etc/imapd	imapd
imaps	stream	tcp	nowait.100	root	/usr/local/etc/imapd	imapd
 (or, if you use TCP wrappers)
pop3	stream	tcp	nowait.100	root	/usr/local/etc/tcpd	ipop3d
imap	stream	tcp	nowait.100	root	/usr/local/etc/tcpd	imapd
pop3s	stream	tcp	nowait.100	root	/usr/local/etc/ipop3d	ipop3d
imaps	stream	tcp	nowait.100	root	/usr/local/etc/imapd	imapd

Note: do *NOT* use TCP wrappers (tcpd) for the imaps and pop3s services!

STEP 2:	services setup

     You may also have to edit your /etc/services (or Yellow Pages,
NetInfo, etc. equivalent) to register these services, such as:

pop		109/tcp
pop3		110/tcp
imap		143/tcp
imaps		993/tcp
pop3s		995/tcp

Note: the SSL IMAP service *MUST* be called "imaps", and the SSL POP3 service
*MUST* be called "pop3s".

STEP 3:	certificates setup

     You must set up certificates on /usr/local/ssl/certs.  You should install
both the certificate authority certificates from the SSL sources, plus your
own certificates.  These should have been purchased from a certificate
authority, although self-signed certificates are permissible.  A sample
certificate file is at the end of this document.

     Install the IMAP certificate on /usr/local/ssl/certs/imapd.pem and the
POP3 certificate on /usr/local/ssl/certs/ipop3d.pem.  These files should be
protected against random people accessing them.  It is permissible for
imapd.pem and ipop3d.pem to be links to the same file.

     If you have a multihomed system with multiple domain names (and hence
separate certifications for each domain name), you can append the IP address
to the service name.  For example, the IMAP certificate for [12.34.56.78]
would be /usr/local/ssl/certs/imapd-12.34.56.78.pem and so on.  You only need
to use this feature if you need to use multiple certificates.

SAMPLE CERTIFICATE FILE

     Here is a sample certificate file.  Do *NOT* use this on your own
machine; it is simply an example of what one would look like.

-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Jason Spangler <[email-masked]>
Date: Mon, 05 Jun 2000 20:33:13 -0500

> their heads about what to do.

That doc will help a lot!  Only things I can think of that might be good to add
are:

Testing with openssl test client like you mentioned earlier:
% openssl
OpenSSL> s_client -host localhost -port 993

Generating a test key yourself:
openssl req -new -x509 -days 365 -nodes -out key.pem -keyout key.pem