メールサーバー間通信内容暗号化(OpenSSL+sendmail+Dovecot)

最終更新日： 2007.12.10

[root@centos ~]# cd /etc/pki/tls/certs/　←　ディレクトリ移動※CentOS5の場合

[root@centos ~]# cd /usr/share/ssl/certs　←　ディレクトリ移動※CentOS4の場合

[root@centos certs]# make mail.pem　←　サーバー証明書作成
umask 77 ; \
PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
/usr/bin/openssl req -newkey rsa:1024 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 ; \
cat $PEM1 >  mail.pem ; \
echo ""    >> mail.pem ; \
cat $PEM2 >> mail.pem ; \
rm -f $PEM1 $PEM2
Generating a 1024 bit RSA private key
.....++++++
....................++++++
writing new private key to '/tmp/openssl.C28807'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP　←　国名応答
State or Province Name (full name) [Berkshire]:Tokyo　←　都道府県名応答
Locality Name (eg, city) [Newbury]:Shinjuku　←　市区町村名応答
Organization Name (eg, company) [My Company Ltd]:centossrv.com　←　サイト名応答(なんでもいい)
Organizational Unit Name (eg, section) []:　←　空ENTER
Common Name (eg, your name or your server's hostname) []:mail.centossrv.com　←　メールサーバー名応答※
Email Address []:postmaster@centossrv.com　←　管理者メールアドレス応答

[root@centos certs]# cd　←　ホームディレクトリへ戻る

[root@centos ~]# vi /etc/mail/sendmail.mc　←　sendmail.mc編集
dnl define(`confCACERT_PATH',`/usr/share/ssl/certs')
dnl define(`confCACERT',`/usr/share/ssl/certs/ca-bundle.crt')
dnl define(`confSERVER_CERT',`/usr/share/ssl/certs/mail.pem')
dnl define(`confSERVER_KEY',`/usr/share/ssl/certs/mail.pem')
−−サーバー証明書の所在を指定(ここから)−−※CentOS5の場合
define(`confCACERT_PATH',`/etc/pki/tls/certs')
define(`confCACERT',`/etc/pki/tls/certs/mail.pem')
define(`confSERVER_CERT',`/etc/pki/tls/certs/mail.pem')
define(`confSERVER_KEY',`/etc/pki/tls/certs/mail.pem')
−−サーバー証明書の所在を指定(ここまで)−−※CentOS5の場合
−−サーバー証明書の所在を指定(ここから)−−※CentOS4の場合
define(`confCACERT_PATH',`/usr/share/ssl/certs')
define(`confCACERT',`/usr/share/ssl/certs/mail.pem')
define(`confSERVER_CERT',`/usr/share/ssl/certs/mail.pem')
define(`confSERVER_KEY',`/usr/share/ssl/certs/mail.pem')
−−サーバー証明書の所在を指定(ここまで)−−※CentOS4の場合

dnl DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl
DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl　←　追加(SMTPS over TLSの有効化)

[root@centos ~]# m4 /usr/share/sendmail-cf/m4/cf.m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf　←　sendmail.mcよりsendmail.cf作成

[root@centos ~]# /etc/rc.d/init.d/sendmail restart　←　sendmail再起動
sendmail を停止中:                                         [  OK  ]
sm-client を停止中:                                        [  OK  ]
sendmail を起動中:                                         [  OK  ]
sm-client を起動中:                                        [  OK  ]

[root@centos ~]# vi /etc/dovecot.conf　←　dovecot設定ファイル編集
# Disable SSL/TLS support.
#ssl_disable = no
ssl_disable = no　←　追加(TLS通信の有効化)

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
#ssl_cert_file = /usr/share/ssl/certs/dovecot.pem
#ssl_key_file = /usr/share/ssl/private/dovecot.pem
−−サーバー証明書の所在を指定(ここから)−−※CentOS5の場合
ssl_cert_file = /etc/pki/tls/certs/mail.pem
ssl_key_file = /etc/pki/tls/certs/mail.pem
−−サーバー証明書の所在を指定(ここまで)−−※CentOS5の場合
−−サーバー証明書の所在を指定(ここから)−−※CentOS4の場合
ssl_cert_file = /usr/share/ssl/certs/mail.pem
ssl_key_file = /usr/share/ssl/certs/mail.pem
−−サーバー証明書の所在を指定(ここまで)−−※CentOS4の場合

[root@centos ~]# /etc/rc.d/init.d/dovecot restart　←　dovecot再起動
Dovecot Imap を停止中:                                     [  OK  ]
Dovecot Imap を起動中:                                     [  OK  ]

[root@centos ~]# cd /etc/pki/tls/certs　←　ディレクトリ移動※CentOS5の場合

[root@centos ~]# cd /usr/share/ssl/certs　←　ディレクトリ移動※CentOS4の場合

[root@centos certs]# openssl x509 -in mail.pem -outform DER -out mail.der　←　インポート用サーバー証明書作成