Postfix 無法從文件 /etc/ssl/private/server.key 中獲取 RSA 私鑰：禁用 TLS 支持

Question

我安裝了一個 postfix 郵件服務器。 但是當我使用thunderbird登錄用戶時是錯誤的。 這是配置。

后配置 -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_size_limit = 20000000000
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 200000000
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = stack.daolicloud.com
myhostname = mail.stack.daolicloud.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
relay_domains = $mydestination
relayhost =
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_note_starttls_offer = yes
smtpd_helo_required = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/cacert.pem
smtpd_tls_key_file = /etc/ssl/private/server.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550

鴿舍-n：

# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-431.1.2.0.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) 
auth_mechanisms = plain login
mail_location = maildir:~/Maildir
mail_privileged_group = mail
mbox_write_locks = fcntl
passdb {
  driver = pam
}
protocols = imap pop3
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
  }
}
service imap-login {
  inet_listener imap {
    port = 143
    ssl = yes
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
ssl_cert = </etc/ssl/certs/cacert.pem
ssl_key = </etc/ssl/private/server.key
userdb {
  driver = passwd
}

這是日志：

 dovecot: imap-login: Fatal: Can't load private ssl_key: Key is for a different cert than ssl_cert
dovecot: master: Error: service(imap-login): command startup failed, throttling
dovecot: pop3-login: Fatal: Can't load private ssl_key: Key is for a different cert than ssl_cert
dovecot: master: Error: service(pop3-login): command startup failed, throttling
postfix/smtpd[13891]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support
postfix/smtpd[13891]: warning: TLS library problem: 13891:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331:
postfix/smtpd[13893]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support
postfix/smtpd[13893]: warning: TLS library problem: 13893:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331:
postfix/smtpd[13894]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support
postfix/smtpd[13894]: warning: TLS library problem: 13894:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331:
postfix/smtpd[13895]: warning: cannot get RSA private key from file /etc/ssl/private/server.key: disabling TLS support
postfix/smtpd[13895]: warning: TLS library problem: 13895:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331:

我認為pem和key文件是錯誤的。 所以我再次生成這個文件，然后是這個鏈接。 但它仍然出現同樣的錯誤。 有任何想法嗎？ 有人可以幫助我嗎？ 非常感謝！

Answer 1

為了檢查證書和密鑰是否匹配使用這個，

(openssl x509 -noout -modulus -in /etc/ssl/certs/cacert.pem | openssl md5 ;\
openssl rsa -noout -modulus -in /etc/ssl/private/server.key | openssl md5) | uniq

如果您獲得多個標識符，則您的密鑰和證書不匹配。

只需創建一個新的；

openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/cacert.pem -keyout /etc/ssl/private/server.key

干杯!

Answer 2

基於@Ark74 某人博客的回答，在 ubuntu 上，snakeoil 證書的檢查命令是：

(openssl x509 -noout -modulus -in /etc/ssl/certs/ssl-cert-snakeoil.pem | openssl md5 ; openssl rsa -noout -modulus -in /etc/ssl/private/ssl-cert-snakeoil.key | openssl md5) | uniq

如果得到兩個哈希值，則需要重新生成證書：

make-ssl-cert generate-default-snakeoil --force-overwrite

Answer 3

對於在運行 SELinux 的 Centos 8、Postfix 3.3.1 上看到此錯誤的任何人，我嘗試了上述所有方法，並且我知道我的證書和鏈是正確的，因為 apache 正在正確加載它們。

我在原始錯誤下看到以下錯誤：

warning: TLS library problem: error:0200100D:system library:fopen:Permission denied

結果證明證書必須在：

/etc/ssl/certs

目錄 - 即使我對它們有正確的 chcon。 認為這可能對其他人有所幫助，因為這非常令人沮喪。 我不確定為什么 Postfix 無法從 httpd 目錄加載它們。