SSL cert location

Last-Update: Sun, 30 Nov 2014 23:59:07 -0500
Bug: #608719

Move dovecots generated X.509 certificate out of /etc/ssl where
it doesn't belong.

Gbp-Pq: Name ssl-cert-location.patch

diff --git a/doc/example-config/conf.d/10-ssl.conf b/doc/example-config/conf.d/10-ssl.conf
index ad8476649f4b7b613a64fd8ae23800c78bc75468..4867a073e732947e6456778e78c06b09417a447d 100644 (file)
--- a/doc/example-config/conf.d/10-ssl.conf
+++ b/doc/example-config/conf.d/10-ssl.conf
@@ -3,14 +3,14 @@
 ##
 
 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
-#ssl = yes
+ssl = yes
 
 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/ssl/certs/dovecot.pem
-ssl_key = </etc/ssl/private/dovecot.pem
+ssl_cert = </etc/dovecot/private/dovecot.pem
+ssl_key = </etc/dovecot/private/dovecot.key
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often
@@ -33,6 +33,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
 # RedHat-based systems. Note that ssl_client_ca_file isn't recommended with
 # large CA bundles, because it leads to excessive memory usage.
 #ssl_client_ca_dir =
+ssl_client_ca_dir = /etc/ssl/certs
 #ssl_client_ca_file =
 
 # Require valid cert when connecting to a remote server

diff --git a/doc/mkcert.sh b/doc/mkcert.sh
index f7e484cf4d4e7710f5a0fbfee20810ada8cf45f5..efcf85ed2dd0c1a3b8d8cca86584da498a7f80bb 100644 (file)
--- a/doc/mkcert.sh
+++ b/doc/mkcert.sh
@@ -8,19 +8,19 @@ OPENSSL=${OPENSSL-openssl}
 SSLDIR=${SSLDIR-/etc/ssl}
 OPENSSLCONFIG=${OPENSSLCONFIG-dovecot-openssl.cnf}
 
-CERTDIR=$SSLDIR/certs
-KEYDIR=$SSLDIR/private
+CERTDIR=/etc/dovecot/ssl
+KEYDIR=/etc/dovecot/ssl
 
 CERTFILE=$CERTDIR/dovecot.pem
-KEYFILE=$KEYDIR/dovecot.pem
+KEYFILE=$KEYDIR/dovecot.key
 
 if [ ! -d $CERTDIR ]; then
-  echo "$SSLDIR/certs directory doesn't exist"
+  echo "$CERTDIR directory doesn't exist"
   exit 1
 fi
 
 if [ ! -d $KEYDIR ]; then
-  echo "$SSLDIR/private directory doesn't exist"
+  echo "$KEYDIR directory doesn't exist"
   exit 1
 fi