{"id":2804,"date":"2013-12-04T09:59:26","date_gmt":"2013-12-04T15:59:26","guid":{"rendered":"https:\/\/secure.rosehosting.com\/blog\/?p=2804"},"modified":"2022-12-19T07:00:18","modified_gmt":"2022-12-19T13:00:18","slug":"set-up-ssl-encrypted-connection-in-postfix-dovecot-and-apache","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/set-up-ssl-encrypted-connection-in-postfix-dovecot-and-apache\/","title":{"rendered":"Set-up SSL encrypted connection in Postfix, Dovecot and Apache"},"content":{"rendered":"
This article is part 3<\/strong> of our part 1<\/strong> mailserver set-up with virtual users and domains using Postfix and Dovecot<\/a> on a CentOS 6 VPS<\/a> and part 2 <\/strong>which explains how to install and set-up the Roundcube webmail interface<\/a><\/p>\n The following post will show you how to set-up SSL encrypted connection<\/strong> to our mailserver installation.<\/p>\n At the end of this article you will end-up using IMAP\/POP3 over SSL<\/strong> (IMAPs<\/strong>\/POP3s<\/strong>) SMTP over SSL<\/strong> (SMTPs<\/strong>) and Roundcube Webmail over SSL<\/strong> (HTTPS<\/strong>)<\/p>\n <\/p>\n As always, make sure your CentOS 6<\/strong> Linux VPS<\/a> is fully up to date by executing:<\/p>\n Next thing we are going to do, is to set-up the SSL certificate file and key. Do this by executing the following:<\/p>\n In order to have your Roundcube webmail<\/strong> system accessible over SSL encrypted connection<\/strong> you will need to set-up Apache’s mod_ssl interface to openssl<\/strong> by running the following commands:<\/p>\n set the paths to the SSL certificate and private key<\/p>\n force SSL encrypted connection when accessing mydomain.com\/webmail:<\/p>\n add the following:<\/p>\n finally, restart Apache for the changes to take effect and try to access http:\/\/mydomain.com\/webmail<\/p>\n In order to enable IMAPs<\/strong> and POP3s<\/strong>, you need to edit dovecot main configuration file ( restart dovecot for the changes to take effect and verify it’s listening on its SSL ports using:<\/p>\n to test IMAPs or POP3s, simply set your email client to use the SSL port, for example for IMAPs 993 and for POP3s 995 and try to receive an email.<\/p>\n To enable SSL support in Postfix so you can send emails using SMTP over SSL, you need to edit two Postfix configuration files. Start with editing then edit restart Postfix for the change to take effect and verify it is listening on its SSL port using:<\/p>\n test SMTPs by setting up your email client to use outgoing port 465.<\/p>\n Implementing SSL encrypted connections<\/strong> to the mailserver set-up with virtual users and domains using Postfix and Dovecot<\/a> and to the Roundcube webmail interface<\/a> on a CentOS VPS<\/a> provide you SSL encrypted connection for outbound and inbound emails.<\/p>\n However, there are other parts missing like anti-spam service, digital signatures using opendkim, filter rules etc for a full-featured mail server. In the next few related articles, we will be adding additional features to the set-up so stay tuned.<\/p>\n Update: Part 4 – How to install and integrate SpamAssassin with Postfix on a CentOS 6 VPS<\/a><\/p>\n Update: Part 5 – How to install and integrate OpenDKIM with Postfix on a CentOS 6 VPS<\/a><\/p>\n Update: Part 6 – How to set-up server-side email filtering with Dovecot Sieve and Roundcube on a CentOS 6 VPS<\/a><\/p>\nUPDATE THE SYSTEM<\/strong><\/h3>\n
## screen -U -S ssl-screen\r\n## yum update<\/pre>\n
SET-UP SSL CERTIFICATE, KEY AND CSR<\/h3>\n
## yum install openssl<\/pre>\n
## mkdir -p ~\/ssl\/mydomain.com\r\n## cd ~\/ssl\/mydomain.com\r\n## openssl genrsa -des3 -out mydomain.com.key 2048\r\n## openssl req -new -key mydomain.com.key -out mydomain.com.csr\r\n## openssl x509 -req -days 365 -in mydomain.com.csr -signkey mydomain.com.key -out mydomain.com.crt\r\n## cp mydomain.com.key{,.orig}\r\n## openssl rsa -in mydomain.com.key.orig -out mydomain.com.key\r\n## chmod 400 mydomain.com.key\r\n\r\n## cp mydomain.com.crt \/etc\/pki\/tls\/certs\r\n## cp mydomain.com.{key,csr} \/etc\/pki\/tls\/private\/<\/pre>\n
\nSET-UP WEBMAIL OVER SSL<\/strong><\/h3>\n
## yum install mod_ssl\r\n## vim +\/SSLCertificateFile \/etc\/httpd\/conf.d\/ssl.conf<\/pre>\n
SSLCertificateFile \/etc\/pki\/tls\/certs\/mydomain.com.crt\r\nSSLCertificateKeyFile \/etc\/pki\/tls\/private\/mydomain.com.key<\/pre>\n
## vim \/etc\/httpd\/conf.d\/90-roundcube.conf<\/pre>\n
RewriteEngine On\r\nRewriteCond %{HTTPS} !=on\r\nRewriteRule ^\/?webmail\/(.*) https:\/\/%{SERVER_NAME}\/webmail\/$1 [R,L]<\/pre>\n
## service httpd restart<\/pre>\n
\nSET-UP IMAP\/POP3 OVER SSL<\/strong><\/h3>\n
\/etc\/dovecot\/dovecot.conf<\/code>) and add\/edit the following:<\/p>\n
protocols = imap pop3\r\n\r\nssl = yes\r\nssl_cert = <\/etc\/pki\/tls\/certs\/mydomain.com.crt\r\nssl_key = <\/etc\/pki\/tls\/private\/mydomain.com.key<\/pre>\n
## service dovecot restart\r\n## ss -tpl | grep -E 'imaps|pop3s'\r\nLISTEN 0 0 *:imaps *:* users:((\"dovecot\",1955,22))\r\nLISTEN 0 0 *:pop3s *:* users:((\"dovecot\",1955,18))<\/pre>\n
\nSET-UP SMTP over SSL<\/strong><\/h3>\n
\/etc\/postfix\/main.cf<\/code> and add the following:<\/p>\n
## vim \/etc\/postfix\/main.cf<\/pre>\n
smtpd_use_tls = yes\r\nsmtpd_tls_key_file = \/etc\/pki\/tls\/private\/mydomain.com.key\r\nsmtpd_tls_cert_file = \/etc\/pki\/tls\/certs\/mydomain.com.crt\r\n\r\nsmtpd_tls_loglevel = 3\r\nsmtpd_tls_received_header = yes\r\nsmtpd_tls_session_cache_timeout = 3600s\r\ntls_random_source = dev:\/dev\/urandom<\/pre>\n
\/etc\/postfix\/master.cf<\/code> and make sure the following line is not commented:<\/p>\n
## vim +\/smtps \/etc\/postfix\/master.cf<\/pre>\n
smtps inet n - n - - smtpd\r\n -o smtpd_tls_wrappermode=yes\r\n -o smtpd_sasl_auth_enable=yes<\/pre>\n
## service postfix restart\r\n\r\n## ss -tnpl | grep 465\r\nLISTEN 0 0 *:465 *:* users:((\"master\",2119,19))<\/pre>\n
\n
\n