Postfix는 /etc/ssl/private/server.key 파일에서 RSA 개인 키를 가져올 수 없습니다. TLS 지원을 비활성화합니다.

Question

후위 메일 서버를 설치했습니다. 하지만 썬더 버드를 사용하여 사용자를 로그인하는 것은 잘못된 것입니다. 이것은 구성입니다.

Postconf의 -n :

alias_database = hash:/etc/aliases 
alias_maps = hash:/etc/aliases 
broken_sasl_auth_clients = yes 
command_directory = /usr/sbin 
config_directory = /etc/postfix 
daemon_directory = /usr/libexec/postfix 
data_directory = /var/lib/postfix 
debug_peer_level = 2 
home_mailbox = Maildir/ 
html_directory = no 
inet_interfaces = all 
inet_protocols = all 
mail_owner = postfix 
mailbox_size_limit = 20000000000 
mailq_path = /usr/bin/mailq.postfix 
manpage_directory = /usr/share/man 
message_size_limit = 200000000 
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain 
mydomain = stack.daolicloud.com 
myhostname = mail.stack.daolicloud.com 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 
myorigin = $mydomain 
newaliases_path = /usr/bin/newaliases.postfix 
queue_directory = /var/spool/postfix 
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES 
relay_domains = $mydestination 
relayhost = 
sample_directory = /usr/share/doc/postfix-2.6.6/samples 
sendmail_path = /usr/sbin/sendmail.postfix 
setgid_group = postdrop 
smtp_tls_note_starttls_offer = yes 
smtpd_helo_required = yes 
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination 
smtpd_sasl_auth_enable = yes 
smtpd_sasl_authenticated_header = yes 
smtpd_sasl_local_domain = $myhostname 
smtpd_sasl_path = private/auth 
smtpd_sasl_security_options = noanonymous 
smtpd_sasl_type = dovecot 
smtpd_sender_restrictions = reject_unknown_sender_domain 
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem 
smtpd_tls_auth_only = no 
smtpd_tls_cert_file = /etc/ssl/certs/cacert.pem 
smtpd_tls_key_file = /etc/ssl/private/server.key 
smtpd_tls_loglevel = 1 
smtpd_tls_received_header = yes 
smtpd_tls_session_cache_timeout = 3600s 
smtpd_use_tls = yes 
tls_random_source = dev:/dev/urandom 
unknown_local_recipient_reject_code = 550 

비둘기장의 -n :

# 2.0.9: /etc/dovecot/dovecot.conf 
# OS: Linux 2.6.32-431.1.2.0.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) 
auth_mechanisms = plain login 
mail_location = maildir:~/Maildir 
mail_privileged_group = mail 
mbox_write_locks = fcntl 
passdb { 
    driver = pam 
} 
protocols = imap pop3 
service auth { 
    unix_listener /var/spool/postfix/private/auth { 
    mode = 0666 
    user = postfix 
    } 
} 
service imap-login { 
    inet_listener imap { 
    port = 143 
    ssl = yes 
    } 
    inet_listener imaps { 
    port = 993 
    ssl = yes 
    } 
} 
ssl_cert = </etc/ssl/certs/cacert.pem 
ssl_key = </etc/ssl/private/server.key 
userdb { 
    driver = passwd 
} 

그리고이 로그됩니다 :

dovecot: imap-login: Fatal: Can't load private ssl_key: Key is for a different cert than ssl_cert 
dovecot: master: Error: service(imap-login): command startup failed, throttling 
dovecot: pop3-login: Fatal: Can't load private ssl_key: Key is for a different cert than ssl_cert 
dovecot: master: Error: service(pop3-login): command startup failed, throttling 
postfix/smtpd[13891]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support 
postfix/smtpd[13891]: warning: TLS library problem: 13891:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331: 
postfix/smtpd[13893]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support 
postfix/smtpd[13893]: warning: TLS library problem: 13893:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331: 
postfix/smtpd[13894]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support 
postfix/smtpd[13894]: warning: TLS library problem: 13894:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331: 
postfix/smtpd[13895]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support 
postfix/smtpd[13895]: warning: TLS library problem: 13895:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331: 

나는 pem 및 key F를 생각한다 잘못되었습니다. 그래서 나는이 파일을 다시 생성하고 this link을 생성합니다. 하지만 여전히 같은 오류가 발생합니다. 어떤 아이디어? 누군가 나를 도울 수 있습니까? 고마워요! 하나 이상의 식별자를 얻을 경우 인증서 및 키 일치 이것을 사용 여부를 확인하기 위해

Answer 1

,

(openssl x509 -noout -modulus -in /etc/ssl/certs/cacert.pem | openssl md5 ;\ 
openssl rsa -noout -modulus -in /etc/ssl/private/server.key | openssl md5) | uniq 

, 당신은 키와 인증서가 일치하지 않습니다.

새로 만들면됩니다.

openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/cacert.pem -keyout /etc/ssl/private/server.key 

건배! snakeoil 인증서를 우분투에 someone's blog에서 Ark74의 대답 @ 체크 명령을 구축

Answer 2

은 다음과 같습니다

(openssl x509 -noout -modulus -in /etc/ssl/certs/ssl-cert-snakeoil.pem | openssl md5 ; openssl rsa -noout -modulus -in /etc/ssl/private/ssl-cert-snakeoil.key | openssl md5) | uniq 

두 해시를 얻을 경우, 인증서가 regenrated 할 필요가 :

make-ssl-cert generate-default-snakeoil --force-overwrite