On 13-3-10 20:19 , Kurt Roeckx wrote:
This works for me:
openssl s_client -CAfile ./vdberg.org.ca.pem -connect vdberg.org:26 -starttls
smtp
Interesting. Does this mean the issue is with postfix only? I checked
the postfix code and there is no use of X509_V_FLAG_CHECK_SS_SIGNATURE
that grep can find. I am running 2.6.5-3 (2.5.5-1.1 had the same issue).
Setting smtpd_tls_loglevel = 3 gives:
Mar 14 08:47:04 majoron postfix/smtpd[31776]: SSL_accept:error in SSLv3
read client certificate A
Mar 14 08:47:04 majoron postfix/smtpd[31776]: SSL_accept error from
82-171-xxx-yyy.ip.telfort.nl[82.171.xxx.yyy]: -1
Mar 14 08:47:04 majoron postfix/smtpd[31776]: warning: TLS library
problem: 31776:error:0D0C50A1:asn1 encoding
routines:ASN1_item_verify:unknown message digest algorithm:a_verify.c:146:
Does this mean the issue is with the client certificate instead of the
server certificate? I am testing with Thunderbird 3.0.3 without any
client certificates, and s_client. Even without the -CAfile the issue is
triggered server side:
openssl s_client -connect vdberg.org:25 -starttls smtp
I'm attaching postfix.pem in case it helps. I can also sign a test
certificate with my CA if needed.
Richard
PS: my server is back to libssl0.9.8_0.9.8k-8 now, so the s_client test
will succeed now
-----BEGIN CERTIFICATE-----
MIICUzCCAbwCAQEwDQYJKoZIhvcNAQELBQAwgZIxEzARBgNVBAoTCnZkYmVyZy5v
cmcxJDAiBgkqhkiG9w0BCQEWFWhvc3RtYXN0ZXJAdmRiZXJnLm9yZzERMA8GA1UE
BxMIVm9vcmJ1cmcxFTATBgNVBAgTDFp1aWQtSG9sbGFuZDELMAkGA1UEBhMCTkwx
HjAcBgNVBAMTFXZkYmVyZy5vcmcgcHJpdmF0ZSBDQTAeFw0wNzAyMTMxMzA4NTJa
Fw0xNzAyMTAxMzA4NTJaMFExCzAJBgNVBAYTAk5MMRUwEwYDVQQIEwxadWlkLUhv
bGxhbmQxEzARBgNVBAoTCnZkYmVyZy5vcmcxFjAUBgNVBAMTDW14LnZkYmVyZy5v
cmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJIfXJNNnWIFG8dhrU0qn2cQ
tBsQTHHdmSTn1991Z4TPkiYotp1jJYlYkSh4ags4niyVz4aClCqIsB619CDSKZKc
SbLMI77+5a+/nvfQ7C91G0Lmcy02AFe4CRILKFpWXv5U59fPgOnPuQuNGoM3Q1DF
c2zOscUZtcuUVe87ZSm5AgMBAAEwDQYJKoZIhvcNAQELBQADgYEAmG4SJ57m0Icq
7XxJZWJGcKj/xm/GnZyYM0SkLeR6uMW9aJIQcXs1AAtF1RKCqEw2abnxn642OEqt
8OZUt6ZfUCrhUCQ3KUM/OJQGX7s0z1V9Y7yo0DxRCHTx7TUJBlCMO2MQN/dHbIMP
MrUYu7d7lIc1TJ08W4yEjZ+42RyfI2E=
-----END CERTIFICATE-----
