i've had an imap server running for a while using inetd, and i decided recently to try implementing it with ssl using stunnel. so i added the following line to my /etc/inetd.conf:
Code:
imaps stream tcp nowait root /usr/sbin/stunnel stunnel /usr/stunnel/imaps.conf
and /usr/stunnel/imaps.conf has only the following:
Code:
cert = /etc/stunnel/stunnel.pem
exec = /usr/sbin/imapd
execargs = imapd
i opened tcp port 993 on my firewall and set up port forwarding from my router to my server. i can now connect successfully using thunderbird with ssl. my problem though, is that thunderbird refuses to recognize the certificate permanently. when i click on that mailbox, a dialog box pops up asking if i would like to
a) accept this certificate permanently
b) accept it for this session only
c) do not accept this certificate and do not connect to this website
if i select choice a, the dialog box simply refreshes. so i select choice b and continue, but i get an error message saying:
Quote:
Security Error: Domain Name Mismatch
You have attempted to establish a connection with "ironmonkey.homelinux.net." However, the certificate presented belongs to "ironmonkey." It is possible, although unlikely, that someone may be attempting to intercept your communication with this website.
|
i click OK and continue without trouble. i can check my mail, send mail, and everything is ok. but i have to go through all that every time i start thunderbird, which is not cool.
i figure i need to issue myself a new certificate for "ironmonkey.homelinux.net" instead of just "ironmonkey." so i struggled through the openssl man page, and the openssl req man page, since i believe that's the command to issue a new certificate. i tried the following:
Code:
openssl req -nodes -x509 -newkey rsa:1024 -keyout key.pem -out req.pem
and then edited /etc/stunnel/imaps.conf to use req.pem as the certificate. unfortunately, thunderbird then gives me an error saying:
Code:
Unable to connect to your IMAP server. You may have exceeded the maximum number of connections to this server.
which is clearly crap. anyone know what i did wrong?
