postfix如何设置才能开启SSL？pem文件如何生成？【已解决，感谢zlj2208】 - Chinaunix

[root@mail ~]# openssl req -new -x509 -nodes -out smtpd.pem -keyout smtpd.pem -days 3650
Generating a 1024 bit RSA private key
.......................................................++++++
...............++++++
writing new private key to 'smtpd.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:Shandong
Locality Name (eg, city) [Newbury]:Qingdao
Organization Name (eg, company) [My Company Ltd]:FBSE
Organizational Unit Name (eg, section) []:Dev
Common Name (eg, your name or your server's hostname) []:fbse
Email Address []:
[root@mail ~]#

复制代码

dir = ../../CA # Where everything is kept

复制代码

dir = /etc/pki/CA # Where everything is kept

复制代码

shell# yum install openssl-perl

复制代码

shell# cd /etc/pki
shell# mv CA CA.bak

复制代码

shell# cd /etc/pki/tls/misc/
shell# ./CA.pl -newca

复制代码

CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
.....++++++
...................................++++++
writing new private key to '../../CA/private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [Liaoning]:Liaoning
Locality Name (eg, city) [Dalian]: Dalian
Organization Name (eg, company) [My Company Ltd]:test dot com
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your server's hostname) []:test
Email Address []:postmaster@test.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ../../CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
f4:60:02:37:19:43:e5:5e
Validity
Not Before: Dec 2 13:23:11 2009 GMT
Not After : Dec 1 13:23:11 2012 GMT
Subject:
countryName = CN
stateOrProvinceName = Liaoning
organizationName = test dot com
organizationalUnitName = test
commonName = test
emailAddress = postmaster@test.com
X509v3 extensions:
X509v3 Subject Key Identifier:
77:21:CF:21:FA:CA:2E:92:D1:7D:9D:D8:F9:7C:05:A1:EE:57:4A:DC
X509v3 Authority Key Identifier:
keyid:77:21:CF:21:FA:CA:2E:92:D1:7D:9D:D8:F9:7C:05:A1:EE:57:4A:DC
DirName:/C=CN/ST=Liaoning/O=test dot com/OU=test/CN=test/emailAddress=postmaster@test.com
serial:F4:60:02:37:19:43:E5:5E
X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Dec 1 13:23:11 2012 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated

复制代码

shell# mkdir /etc/pki/myca
shell# cd /etc/pki/myca

复制代码

shell# openssl req -new -nodes -keyout mailkey.pem -out mailreq.pem -days 3650

复制代码

Generating a 1024 bit RSA private key
....++++++
....++++++
writing new private key to 'mailkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]: CN
State or Province Name (full name) [Liaoning]: Liaoning
Locality Name (eg, city) [Dalian]: Dalian
Organization Name (eg, company) [My Company Ltd]:test dot com
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your server's hostname) []:test
Email Address []:postmaster@test.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

复制代码

shell# cd /etc/pki/myca
shell# ls -l
total 8
-rw-r--r-- 1 root root 887 Dec 2 21:28 mailkey.pem
-rw-r--r-- 1 root root 700 Dec 2 21:28 mailreq.pem

复制代码

shell# openssl x509 -req -days 3650 -in mailreq.pem -signkey mailkey.pem -out mailcert.pem

复制代码

Signature ok
subject=/C=CN/ST=Liaoning/L=Dalian/O=test dot com/OU=test/CN=test/emailAddress=postmaster@test.com
Getting Private key

复制代码

shell# cp /etc/pki/CA/cacert.pem /etc/pki/myca

复制代码

# tls setting for smtp server
smtpd_use_tls = yes
smtpd_tls_key_file = /etc/pki/myca/mailkey.pem
smtpd_tls_cert_file = /etc/pki/myca/mailcert.pem
smtpd_tls_CAfile = /etc/pki/myca/cacert.pem
#smtpd_tls_security_level = encrypt
smtpd_tls_received_header = yes
smtpd_enforce_tls = yes
smtpd_tls_loglevel = 2
# tls setting for smtp client
smtp_use_tls = yes
smtp_tls_key_file = /etc/pki/myca/mailkey.pem
smtp_tls_cert_file = /etc/pki/myca/mailcert.pem
smtp_tls_CAfile = /etc/pki/myca/cacert.pem
#smtp_tls_policy_maps = hash:/etc/postfix/tls_policy_maps

复制代码

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

复制代码