SSL configuration

AfterLogic XMail Server uses to identify itself during SSL negotiations, by the mean of the two files 'SERVER.CERT' and 'SERVER.KEY'. These files 'MUST' be available inside the 'MAIL_ROOT' directory. Both are in PEM format, and one represent the server certificate file ('SERVER.CERT') while the other represent the server private key file ('SERVER.KEY'). AfterLogic XMail Server uses the OpenSSL libraries for its SSL operations. http://www.openssl.org/docs/HOWTO/certificates.txt contains examples about how to create certificates to be use by AfterLogic XMail Server, while http://www.openssl.org/docs/HOWTO/keys.txt describes own to generate keys. In order to properly manage your AfterLogic XMail Server server when using SSL support, you need to have access to the OpenSSL binary. For Unix ports, this is available as a package, whose name varies depending on the distribution. For Windows, pre-built versions of theOpenSSL libraries and binary are supplied inside the ''win32ssl'' directory of the AfterLogic XMail Server source package. For example, to create a self-signed certificate, you first have to create a private key with:

  $ openssl genrsa 2048 > server.key

After you have created the private key, you can create you own copy of the self-signed certificate with:

  $ openssl req -new -x509 -key server.key -out server.cert
  C:> openssl req -new -x509 -key server.key -out server.cert -config openssl.cnf

If you want to have a certificate signed by an authority, you need to generate a certificate request file:

  $ openssl req -new -key server.key -out cert.csr
  
  C:> openssl req -new -key server.key -out cert.csr -config openssl.cnf

The 'openssl.cnf' file is supplied inside the Xmail's Windows binary package, and inside the 'win32ssl\conf' directory of the source package. The 'cert.csr' file needs then to be submitted to the certificate authority in order to obtain a root-signed certificate file (that will be your 'SERVER.CERT'). The behaviour of the AfterLogic XMail Server SSL module is controlled by a few 'SERVER.TAB' variables:

[SSLWantVerify]

Tells the SSL link negotiation code to verify the remote peer certificate. If this is enabled, you need to use either SSLUseCertsFile or SSLUseCertsDir to provide a set of valid root certificates. You can also add your own certificates in the set, in order to provide access to your servers by clients using certificates signed by you.

[SSLWantCert]

Tells the SSL link negotiation code to fail if the remote peer does not supply a certificate.

[SSLAllowSelfSigned]

Allows self-signed certificates supplied by remote peers.

[SSLMaxCertsDepth]

Set the maximum certificate chain depth for the verification process.

[SSLUseCertsFile]

When using SSLWantVerify, the SSL code will verify the peer certificate using standard SSL certificate chain verification rules. It is possible to supply to AfterLogic XMail Server an extra list of valid certificates, by filling up a 'CERTS.PEM' file and setting SSLUseCertsFile to 1. The 'CERTS.PEM' is a concatenation of certificates in PEM format.

[SSLUseCertsDir]

In the same way as SSLUseCertsFile does, setting SSLUseCertsDir to 1 enables the usage of extra valid certificates stored inside the 'CERTS' AfterLogic XMail Server sub-directory. The 'CERTS' containes hashed file names that are created by feeding the directory path to the 'c_rehash' OpenSSL Perl script (a Windows-friedly version of 'c_rehash', named 'c_rehash.pl' is contained inside the 'win32ssl\bin' subdirectory of the source package). Unix users will find proper CA certificates inside the standard install paths of OpenSSL, while Windows users will find them inside the 'win32ssl\certs' subdirectory of the source package. To use 'c_rehash' you need to have the OpenSSL binaries (executable and shared libraries) correctly installed in your system, and the executable reacheable from your PATH. Then you simply run it by passing the path to the PEM certificates directory ('CERTS'). The 'c_rehash' script will call the OpenSSL binary and will generated hashed file names (that are either symlinks or copies) that point/replicate the mapped certificate.

[top]