Multi SAN Certificate creation and use

Question

Level 1

94 points

Multi SAN Certificate creation and use

Hello everyone and Merry Xmas!

I don't know if the question falls into the Mail Services area, but here it is:

I have setup a 10.6.2 Server with a .lan domain and I use virtual domain (company.gr) in Mail.

I have setup DNS with two zones, the .lan zone and the .gr zone.
In the .gr zone I have only the internet name of my server pointed to the internal IP. The goal is when the computers are in the company's network to be able to reach the server for Mail services with the same name when they are out of the company's network.

I need to create an SSL certificate (with my server as CA) to support more than one Subject Alternate Names and IPs (mail.company.gr, server.company.gr, internal IP, external IP). I create one using Server Admin's tool, but when I try to use it in Mail, POP and IMAP cannot start.

I did not delete the default certificate.

Is there any special procedure for creating a self-signed multi SAN certificate?
Shall I delete the default?

Thanks you all

Kostas

Dual 1.25 PowerPC G4 - MacBook Pro 2.16, Mac OS X (10.6.2), ACMT, ACHDS 10

Posted on Dec 28, 2009 12:40 AM

Reply

Answer 1

Dec 28, 2009 8:55 AM in response to Kostas B

Beyond what Mac OS X Certificate Assistant and its SAN certificate creation path leads you through? (You can get at the Certificate Assistant tool in various ways including via Keychain menus. I usually pick the override defaults path when I'm creating a local certificate.) AFAIK, No. You do need functional DNS. What are the error message(s) around mail failing to start?

Reply

Answer 2

Kostas B Author

Level 1

94 points

Dec 28, 2009 3:31 PM in response to MrHoffman

I too followed the Create Certificate Identity wizard without the defaults. In the place that asksk for the SANs I put the other names of the server (mail.company.gr, server.company.gr etc).

Here is the Mail Access log when I'm trying to enable SSL on Mail:

Fatal: ssl cafile: Can't use /etc/certificates/server.COMPANY.lan.5C89F26BA891D18C99346B9E763E0D823E5877FC.c hain.pem server.COMPANY.gr
mail.COMPANY.gr.349E2636E98215BC6F594770B5FF8DE6B31BA19C.chain.pem server.COMPANY.gr mail.COMPANY.gr.349E2636E98215BC6F594770B5FF8DE6B31BA19C.chain.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.chain.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.chain.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.chain.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.chain.pem: File name too long

Thanks

Kostas

Reply

Answer 3

Jan 6, 2010 3:52 PM in response to Kostas B

Is there an answer to this? I have the same problem with all certificates created within Server Admin. Renaming the cert files doesn't work, of course.

I'm thinking about trying to create a certificate via OpenSSL and use it. Sad thing is, I know very little about the intricacies of OpenSSL & creating certificates for OS X.

Thanks for any insight.

Reply

Answer 4

Jan 7, 2010 3:14 PM in response to Kostas B

I finally got IMAP & POP services to launch using SSL. It had nothing to do with certificates and their names, or creating them in openssl, and everything to do with a botched dovecot.conf file, courtesy of Server Admin.

It appears that every time I changed the certificate for IMAP & POP SSL in Server Admin, it appended the new selection to the dovecot.conf file on 3 separate lines. The result was an unhealthy list of every certificate file Server Admin had ever been pointed to for this service.

After making a backup, I edited the file in pico (/etc/dovecot/dovecot.conf) down to the single cert file I wanted it to use and deleted the other entries. The most recent certificate happened to be first in the list, FWIW.

If you want to duplicate this, look for the lines beginning with:
"ssl certfile"
"ssl keyfile"
"ssl cafile"

Obviously you need to be careful in here. But I did not even have to bounce the service before it took my changes. Thankfully, Server Admin did not overwrite my edits (which I've seen happen with manual config of other services, such as the iChat service.)

Good luck, and let me know if I can provide more detail.

Reply

Answer 5

Kostas B Author

Level 1

94 points

Jan 9, 2010 10:45 AM in response to Axiom Attic

Hello and thanks for the info.

In my case, using the default certificate, SSL works fine in Mail. When I try to use a certificate created from me using more than one Subject Alternate Names, then the problem starts.

Here is my output of my dovecot.conf

ssl certfile = /etc/certificates/server.COMPANY.lan.5C89F26BA891D18C99346B9E763E0D823E5877FC.c ert.pem server.COMPANY.gr mail.COMPANY.gr.349E2636E98215BC6F594770B5FF8DE6B31BA19C.cert.pem server.COMPANY.gr mail.COMPANY.gr.349E2636E98215BC6F594770B5FF8DE6B31BA19C.cert.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.cert.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.cert.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.cert.pem mail.COMPANY.gr.3E348A632F4688EBD04664E75960EA637C196129.cert.pem

Any help will be appreciated!

Kostas

Reply