Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Tue, Aug 25, 2015 at 02:56:52PM +0000, Peter Gutmann wrote:

> Compare this to a cut&paste of:
> 
> openssl req -x509 -newkey rsa:2048 -nodes -keyout /etc/ssl/private/key.pem -out /etc/ssl/certs/cert.pem -days 3650 -subj '/CN=mail.example.com' 
> 

For Postfix,

    http://www.postfix.org/TLS_README.html#quick-start

it takes a one more 'postconf' command to actually turn on TLS
after the key and cert are generated:

    # dir="$(postconf -h config_directory)"
    # fqdn=$(postconf -h myhostname)
    # case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
    # ymd=$(date +%Y-%m-%d)
    # key="${dir}/key-${ymd}.pem"; rm -f "${key}"
    # cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
    # (umask 077; openssl genrsa -out "${key}" 2048) &&
      openssl req -new -key "${key}" \
	-x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
      postconf -e \
	"smtpd_tls_cert_file = ${cert}" \
	"smtpd_tls_key_file = ${key}" \
	'smtpd_tls_security_level = may' \
	'smtpd_tls_received_header = yes' \
	'smtpd_tls_loglevel = 1' \
	'smtp_tls_security_level = may' \
	'smtp_tls_loglevel = 1' \
	'smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache' \
	'tls_random_source = dev:/dev/urandom'

And the key/cert generation is done with a bit more finesse to set
a sensible umask, avoid clobbering previous key/cert files that
might be in live use, deal with Debian's "myhostname" in a file, etc.

> (I've long been an advocate of software auto-generating a key on install and
> allowing the user to override it if they want further customisation.

I concur, but am a bit worried about low entropy at system build
time.

-- 
	Viktor.