Commit 74ec3d96 authored by Joshua Tauberer's avatar Joshua Tauberer

ssl: there is no need to use -des3 in key generation if we're just going to remove the passphrase

thanks @konklone for discussion
parent 532c9aa7
...@@ -210,9 +210,7 @@ tools/editconf.py /etc/dovecot/conf.d/10-ssl.conf \ ...@@ -210,9 +210,7 @@ tools/editconf.py /etc/dovecot/conf.d/10-ssl.conf \
# Create a self-signed certifiate. # Create a self-signed certifiate.
mkdir -p $STORAGE_ROOT/ssl mkdir -p $STORAGE_ROOT/ssl
if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then
openssl genrsa -des3 -passout pass:x -out /tmp/server.key 2048 # create key, but it has a password... openssl genrsa -out $STORAGE_ROOT/ssl/ssl_private_key.pem 2048
openssl rsa -passin pass:x -in /tmp/server.key -out $STORAGE_ROOT/ssl/ssl_private_key.pem # remove password and save it to the right location
rm /tmp/server.key # remove temporary password-laden key
openssl req -new -key $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr \ openssl req -new -key $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr \
-subj "/C=/ST=/L=/O=/CN=$PUBLIC_HOSTNAME" -subj "/C=/ST=/L=/O=/CN=$PUBLIC_HOSTNAME"
openssl x509 -req -days 365 \ openssl x509 -req -days 365 \
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment