On Wed, Oct 05, 2022 at 10:08:29AM +0200, Michael wrote:
> I started out with
>
> smtpd_tls_ask_ccert = yes
>
> but was irritated about the 'Untrusted TLS connection', b/c the client
> established a 'Verified TLS connection' with
>
> smtp_tls_security_level = fingerprint
> smtp_tls_fingerprint_digest = sha256
> smtp_tls_fingerprint_cert_match = <sha256 fingerprint>
The client successfully verifies the server, but the server has no
PKIX-based trust path to verify the client's certificate based on a CA
signature. This is just fine, because you have an even better security
model, you have an explicit a priori list of the allowed client keys.
The CA signature is pointless and redundant.
> So, to please men with ties, who don't know that an unverfied tls
> connection can still be secure, and client access is restricted with
>
> smtpd_client_restrictions = permit_tls_clientcerts, reject
Tell the men with ties that they're deeply misguided, and requiring
CA trust just makes your configuration fragile, because now you have
to worry about certificate "expiration", working with clients to
update their certificates, ...
> I have to add a CA and signed certificates, to get a 'Verified TLS
> connection' on the server side, too. That's the thing I hoped to
> avoid, b/c it adds another level of complexity, but so be it.
Don't give in to the dark side, security theatre is a waste of your time
and their budget. You don't need to "authenticate" the clients, you
just need to authorise them to send mail. Your relay keys table does
just that. The client certificates can be svelte key containers with
an empty subject and issuer DN:
$ conf=$(printf '%s\n%s\n%s\n' \
"$(printf '%s\n%s\n%s\n' \
'[req]' 'distinguished_name=dn' 'default_md=sha256')" \
"$(printf '%s\n%s\n' \
'[dn]' 'prompt=yes')" \
"$(printf '%s\n%s\n' \
'[exts]' 'basicConstraints = critical,CA:false')"
)
$ tmp=$(mktemp cert.XXXXXX) && \
openssl req -nodes -newkey rsa:2048 -keyout /dev/stdout \
-x509 -extensions exts -subj / -days 36524 \
-config <(printf "%s\n" "$conf") >> "$tmp" && \
mv "$tmp" keycert.pem
Note that on Linux systems it essential to use ">>" and not ">" when
creating the output tempfile.
--
Viktor.
