LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 07-11-2006, 11:41 AM   #1
sigtau66
LQ Newbie
 
Registered: Jul 2005
Posts: 7

Rep: Reputation: 0
TLS (SSL) Between Sendmail and Outlook


Hi all. I've been scouring google and this website for the past 2 days trying to get a resolution to my issue. I've set up Sendmail on an FC5 box. The only customers using Outlook through this server want SSL enabled. That's fine, I did that already as a default and just enabled it through the sendmail config. Now, my issue is that annoying message that pops up every time in Outlook when you first open it and send/receive.

Quote:
The server you are connected to is using a security certificate that could not be verified. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Now, I'm a relative noob on setting up Sendmail. This is now my second time setting it up and even though both have worked, I'm sure it's not ideal. I'm also not an expert in the world of Linux, though I can hold my own. With that said, in this instance, I will need some hand holding.

Now, on to what I've done. I've followed some how-tos on setting up Sendmail with TLS and created 3 pem files in /etc/mail/certs and that is where my Sendmail config is pointing to. I have Dovecot configured for pop3 and imap access. I have the dovecot-openssl.cnf in /etc/pki/dovecot configured so that when I create the keys, they have the right information, namely that the CN matches what Outlook will connect to. In /etc/pki/dovecot/certs and /etc/pki/dovecot/private I have a dovecot.pem that was created. Following further instructions on how to create a .p12, I did that, from the dovecot.pem files, so that I could manually import the certificate into Outlook thinking that would resolve my issue.

Now, I can check the certificates in IE and see that it's there under Trusted Root Certification Authorities, is issued to and by the same server name that Outlook is connecting to, but every time I send/receive in Outlook, I'm prompted by that message. I'm completely at a loss here. The only thing that I can come up with is that my machine is bugged and it's not the actual certificates that are the issue. Can anybody else shed some light for me?

Thanks.
 
Old 07-11-2006, 08:56 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,766
Blog Entries: 54

Rep: Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976
terminated in a root certificate which is not trusted by the trust provider.
You exported the certificate signed by your CA but you didn't export that root CA Certificate. IIGC it goes something like: "openssl pkcs12 -export -in dovecot.pem -inkey CA.key -out CA.p12" and then import the CA.p12 file in the Trusted Root Certification Authorities Store.
 
Old 07-12-2006, 11:51 AM   #3
sigtau66
LQ Newbie
 
Registered: Jul 2005
Posts: 7

Original Poster
Rep: Reputation: 0
I think at this point, I don't quite understand the certificates and why I created what I created from the instructions I followed. That's probably where I'm getting lost at. So to give further information, here are the commands I followed while setting up Sendmail and Dovecot.

For sendmail, I did this:

Quote:
openssl req -new -x509 -keyout cakey.pem -out cacert.pem -days 365
Quote:
openssl req -nodes -new -x509 -keyout sendmail.pem -out sendmail.pem -days 365
Those are located in /etc/mail/certs

Then for Dovecot, I ran the mkcert.sh script which is configured to create the certs in /etc/pki/dovecot/certs and /etc/pki/dovecot/private

That script creates 2 files called dovecot.pem in their respective directories.

Now, what I don't understand is which ones am I supposed to use to create the export file. I think I've tried every combination, but I've yet to get it to work.

Also, I'm new to the certificate world, so I'm still trying to get a handle on them.

Once again, thanks for any assistance you can give!
 
Old 07-14-2006, 12:20 PM   #4
sigtau66
LQ Newbie
 
Registered: Jul 2005
Posts: 7

Original Poster
Rep: Reputation: 0
Still looking for assistance. I haven't been able to figure this one out yet.

Thanks!
 
Old 07-14-2006, 01:48 PM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,766
Blog Entries: 54

Rep: Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976Reputation: 2976
Maybe 2.4. Install the CA root certificate as a Trusted Root Certificate from the SSL Certificates HOWTO can help.
 
Old 08-30-2006, 10:40 PM   #6
wls
LQ Newbie
 
Registered: Aug 2006
Posts: 5

Rep: Reputation: 0
Trusting sendmail root CA

If the end user opens the site via IE, on the smtps/imaps ports, the certificates should install (with prompts) and thereafter Outlook will trust them.

i.e.

https://mail.yourhost.ca:465

and

https://mail.yourhost.ca:993
 
  


Reply

Tags
certificates, outlook, sendmail, ssl


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Proftpd and SSL/TLS mikeheggy Linux - Networking 3 12-19-2008 11:01 AM
vsftpd ssl/tls jefffq Linux - Software 2 07-05-2005 07:38 PM
apache SSL/TLS overlord73 Linux - Security 3 05-12-2005 06:53 AM
FTP via SSL (TLS) embsupafly Linux - Security 2 03-02-2005 09:47 PM
SSL vs. TLS X11 Linux - Security 8 12-17-2002 04:39 PM


All times are GMT -5. The time now is 11:50 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration