I'm trying to create the self-signed server certificate for the Postfix user:
thufir@dur:~$ thufir@dur:~$ sudo ./tls.script Error opening Private Key 3073578684:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('','r') 3073578684:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400: unable to load Private Key thufir@dur:~$ thufir@dur:~$ nl tls.script 1 # dir="$(postconf -h config_directory)" 2 # fqdn=$(postconf -h myhostname) 3 # case $fqdn in /*) fqdn=$(cat "$fqdn");; esac 4 # ymd=$(date +%Y-%m-%d) 5 # key="${dir}/key-${ymd}.pem"; rm -f "${key}" 6 # cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}" 7 # (umask 077; openssl genrsa -out "${key}" 2048) && 8 openssl req -new -key "${key}" \ 9 -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" && 10 postconf -e \ 11 "smtpd_tls_cert_file = ${cert}" \ 12 "smtpd_tls_key_file = ${key}" thufir@dur:~$ as per the Postfix quick-start on TLS.
thufir@dur:~$ postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases append_dot_mydomain = no biff = no broken_sasl_auth_clients = yes config_directory = /etc/postfix default_transport = error home_mailbox = Maildir/ inet_interfaces = all mailbox_command = mailbox_size_limit = 0 mailman_destination_recipient_limit = 1 mydestination = dur.bounceme.net, localhost.bounceme.net, localhost myhostname = dur.bounceme.net mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname readme_directory = no recipient_delimiter = + relay_domains = lists.dur.bounceme.net relay_transport = error relayhost = smtp_tls_note_starttls_offer = yes smtp_tls_security_level = may smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/dovecot-auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = reject_unknown_sender_domain smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem smtpd_tls_auth_only = no smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt smtpd_tls_key_file = /etc/ssl/private/smtpd.key smtpd_tls_loglevel = 2 smtpd_tls_mandatory_ciphers = medium smtpd_tls_mandatory_protocols = SSLv3, TLSv1 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes tls_random_source = dev:/dev/urandom transport_maps = hash:/etc/postfix/transport thufir@dur:~$ Do I need to run the script from a certain location? I was just running it from my home directory, with sudo.
Incidentally, I would be ok with using the snake oil certificate.
11 Answer
Fixed the issue using the helpful reply of muru in a comment.
Uh, those
#signs in the Howto are supposed to represent the prompt. They're not meant to be part of a script. Each # represents the beginning of a new command.
thufir@dur:~$ thufir@dur:~$ sudo ./tls.script [sudo] password for thufir: Generating RSA private key, 2048 bit long modulus ....................................................................+++ .........................................+++ e is 65537 (0x10001) The content of tls.script should be like this (without the leading # marks as in the question)
dir="$(postconf -h config_directory)" fqdn=$(postconf -h myhostname) case $fqdn in /*) fqdn=$(cat "$fqdn");; esac ymd=$(date +%Y-%m-%d) key="${dir}/key-${ymd}.pem"; rm -f "${key}" cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}" (umask 077; openssl genrsa -out "${key}" 2048) && openssl req -new -key "${key}" \ -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" && postconf -e \ "smtpd_tls_cert_file = ${cert}" \ "smtpd_tls_key_file = ${key}" 
