Tag Archives: OpenSSL

Test TLS version on SMTP

My server had some issues sending mail in a secure manner. Somehow that SASL Authentication failed. After this was fixed I wanted to determine what TLS version and ciphers were used. After some time searching the web for an online tool that would do the job for me I thought about an OpenSSL parameter that could do the job for me. Run the following command:

openssl s_client -connect somedomain.tld:25 -starttls smtp

Of course it should represent the content of the MX record for that domain. In my case the following output was what I wanted to know:

New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384

 

Good luck!

Strict security for Plesk mail services

Plesk 12 comes with support voor Dovecot Secure IMAP server. This is a great improvement on the Courier IMAP server. I personally prefer Postfix for SMTP. You can configure Postfix in a very secure manner. In this post I will discuss how to configure Dovecot and Postfix and to configure Roundcube webmail for additional support.

Dovecot
Dovecot supports IMAP4 and POP3. I decided to disable POP3 as it is inferior to IMAP4. If you do want POP3 enabled you should alter the configuration. I disallowed a number of insecure ciphers. I disabled plaintext authentication as it is highly insecure. Note that even though you client is using SSL you can still be vulnerable to attack if Plain text authentication is enabled. Next I changed to directory for the certificate.

First install Dovecot if you haven’t done so. Establish a SSH connection to the server en vi the file:

/etc/dovecot/conf.d/01-servername.conf

01 makes it the last applied file. Adjust the content to your liking:

protocols = imap
ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4
ssl_prefer_server_ciphers = yes
disable_plaintext_auth = yes
ssl_cert = </etc/dovecot/private/certificate.pem
ssl_key = </etc/dovecot/private/key.pem

This configuration encrypts IMAP4 traffic, disabled plain text authentication and enables a verifiable certificate. It diables a number of insecure ciphers and prefers better ciphers.

Postfix
Postfix is used by a massive amount of mail servers. Postfix by default is not configured in a safe manner. To enable Postfix to contact the rest of the world in a safe way you should enable certain ciphers. Furthermore you shouldn’t configure your Postfix server with EDH Ephemeral Diffie–Hellman. Most servers don’t support it yet which would lead to undeliverable mails. Instead use the Diffie-Hellman key exchange. You first need to create a 512 bit key exchange parameter file and a 1024 bit key exchange parameter file. Please note that a larger key length will result in a serious CPU penalty. To generate the files enter the commands below.

openssl gendh -out /etc/postfix/dh_512.pem -2 512
openssl gendh -out /etc/postfix/dh_1024.pem -2 1024

Next configure Postfix’s main.cf file:

vi /etc/postfix/main.cf

Remove the conflicting lines and add the lines below:

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/certificate_2014.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem
smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
smtpd_tls_eecdh_grade = strong
smtpd_tls_protocols= !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3
smtpd_tls_security_level=encrypt
smtpd_tls_mandatory_ciphers = high
tls_preempt_cipherlist = yes
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
smtp_tls_security_level = may

This will not be the most secure configuration. But please keep in mind that enforcing very high security standards will come at a high price.

Roundcube
When you altered the configuration above you need to restart the service of Postfix and Dovecot:

/etc/init.d/postfix restart
/etc/init.d/dovecot restart

When that is done your default Roundcube won’t work no more. This can be fixed by doing the following:

vi /usr/share/psa-roundcube/config/defaults.inc.php

Change the following values:

// IMAP
// ----------------------------------

// The mail host chosen to perform the log-in.
// Leave blank to show a textbox at login, give a list of hosts
// to display a pulldown menu or set one host as string.
// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
// Supported replacement variables:
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %s - domain name after the '@' from e-mail address provided at login screen
// For example %n = mail.domain.tld, %t = domain.tld
// WARNING: After hostname change update of mail_host column in users table is
//          required to match old user data records with the new host.
$config['default_host'] = 'ssl://hostname.TLD';
@include "/etc/psa-webmail/roundcube/mailhosts.php";

// TCP port used for IMAP connections
$config['default_port'] = 993;

// IMAP AUTH type (DIGEST-MD5, CRAM-MD5, LOGIN, PLAIN or null to use
// best server supported one)
$config['imap_auth_type'] = DIGEST-MD5;


// ----------------------------------
// SMTP
// ----------------------------------

// SMTP server host (for sending mails).
// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
// If left blank, the PHP mail() function is used
// Supported replacement variables:
// %h - user's IMAP hostname
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %z - IMAP domain (IMAP hostname without the first part)
// For example %n = mail.domain.tld, %t = domain.tld
$config['smtp_server'] = 'tls://hostname.tld';

// SMTP port (default is 25; use 587 for STARTTLS or 465 for the
// deprecated SSL over SMTP (aka SMTPS))
$config['smtp_port'] = 587;

This will restore the Roundcube functionality.

Certificates decode and some details

So I was reading a wonderful book about SSL and TLS. It is really interesting. For a customer I requested my first SHA256 certificate back in december 2012. My first SHA256 certificate have been issued on february 2013. Now I wanted to request a SHA384 certificate which of course belongs to the SHA2 family. The thing is that I saw various CA changing their chain for SHA1 to SHA384 or from SHA256 tot SHA384. An example is Comodo (which is now in the process of reverting to SHA256). I created a CSR which had the algorithm sha384WithRSAEncryption. I have send the certificate to StartSSL an got back a SHA256 certificate. Now nothing  is wrong with that as probably most browsers do not even support SHA384 at the moment of writing. However I do wanted to spend some attention to this. To check what kind of algorithm your certificate have you can run the following code:

openssl x509 -in Certificatefile.cert  -text

 

To check what kind of algorithm your CSR has you can run the following code:

openssl req -in blabla.csr -text

 

SHA2 certificate OpenSSL Windows

If you have Windows and an OpenSSL installation you can request a SHA256 certificate using the followin code:

set domein=YourDomain
set pass=YourPassword
set organisatie=YourOrganisation
set provincie=YourProviceorState
set stad=YourCity
set string="/CN=%domein%/O=%organisatie%/C=NL/ST=%provincie%/L=%stad%"
echo %string%
openssl genrsa -des3 -passout pass:%pass% 2048 > %domein%.key
openssl rsa -in %domein%.key -passin pass:%pass% -out %domein%-decrypted.key
openssl req –sha256 -new -key %domein%-decrypted.key -subj %string% -out %domein%.csr

SHA2 certificate OpenSSL Linux

To generate a certificate signing request with requesting a SHA256 signed certificate you can run the following script on a linux box with OpenSSL installed on it. Run this Shell script. chmod +X of course

 

domein=YourFQDN
pass=YourPassword
organisatie=YourOrganisation
provincie=YourProvince
stad=YourCity

string=/CN=$domein/O=$organisatie/C=NL/ST=$provincie/L=$stad
openssl genrsa -des3 -passout pass:$pass 2048 > $domein.key
openssl req -sha256 -new -key $domein.key -passin pass:$pass -subj $string -out $domein.csr
openssl rsa -in $domein.key -passin pass:$pass -out $domein-decrypted.key

~

This script will output a private key, a decrypted private key and a CSR.

If you received the CA’s response and it is in a wrong format you can run all of the lines below. If you received a PEM formatted response you can just the line with PKCS12 OpenSSL command.

 

domein=YourFQDN
pass=YourPassword

openssl x509 -in $domein.cer  -out $domein.der -outform DER
openssl x509 -in $domein.der -inform DER -out $domein.pem -outform PEM
openssl pkcs12 -export -in $domein.pem -inkey $domein.key -passin pass:$pass -out $domein.pfx -passout pass:$pass -name $domein

Certificaat aanvragen en converteren met OpenSSL

Certificaten kunnen in openssl worden geconverteerd. Het aanpassen van de indeling is een van de opties die openssl ondersteund. Zolang het certificaat een x509 standaard is kunnen onderstaande commando’s gebruiker worden voor een dergelijke actie:

Het aanvragen van een certificaat gaat als volgt in OpenSSL.

Genereren van een RSA private key:

openssl genrsa -des3 2048 > private.key

Genereren van een PKCS#10 CSR:

openssl -req -new -key private.key -out certificaat.csr

Hierna kan bij de CA een certificaat aangevraagd worden. De CA zal over het algemeen een certificaat aanleveren in de CER indeling. Om een PFX bestand te maken dient het certificaat van de CER indeling naar de PEM indeling worden geconverteerd. Dit gaat als volgd:

openssl x509 -in certificaat.cer -out certificaat.der -outform DER

openssl x509 -in certificaat.der -out certificaat.pem -outform pem

Nadat het certificaat is omgezet naar de PEM indeling kan er een PFX of PKCS#12 aangemaakt te worden:

openssl pkcs12 -export -in certificaat.pem -inkey private.key -out certificaat.pfx -name Friendly name