SSL Certificate Signing with CAcert for Raspberry Pi, Ubuntu & Debian

Powered by Drupal
Submitted by Sam Hobbs on

CAcert logo If you run your own website, email server or other services like OwnCloud at home then you may find yourself in need of a SSL certificate. When you install Apache, it generates a self-signed "snakeoil" certificate that can be used to encrypt your session. However, while this certificate is useful for testing purposes, it falls short in a couple of important ways:

  1. The snakeoil certificate has not been signed by an authority that your browser trusts, so your browser will throw an error when you connect.
  2. The common name on the certificate probably doesn't match your domain name. Another browser error.
  3. Short of manually inspecting the certificate's checksum, you have no guarantee that you are communicating with your own server - it could easily be an imposter using another self-signed certificate.

This tutorial will show you how to generate your own SSL certificate, and get it signed by the community driven SSL certificate signing authority CAcert. Once you have imported the certificate into your browser or into your operating system's root filesystem, your computer will automatically verify the identity of the server and you will enjoy error-free secure communications. Oh, and CAcert is free of charge!

Before we start: a quick note about filename extensions

As far as I can tell, Linux is not at all bothered about what you name your certificate and certificate key files. You could use the .magic extension for your cert if you liked and it would probably still work. From what I've read, file name extensions seem to only matter on Windows, whereas on Linux they're just descriptive. However, it's probably worth noting that there are lots of different types of certificate encoding styles, which have been summarised neatly here. Some extensions such as .pem and .der imply that the file is encoded in a certain way. Since we are able to choose whatever extension we like, I've chosen the following:

  • .csr for the certificate signing request (CSR)
  • .crt for the signed certificate file
  • .key for the key file

These have the benefit of not implying any particular encoding. The first time I did this on my Pi, I used .pem for everything and got in a muddle, forgetting which file was which. This should make things much easier!

Generate your certificate

We are going to use a two step process to generate your certificate. First, run this command, which will generate a private key:

openssl genrsa -out <filename for your private key>.key 4096

Now we will generate a new certificate signing request (CSR) from your private key:

openssl req -new -key <filename for your private key>.key -out <filename for the CSR>.csr

This stage requires user input, a series of questions about what information you would like to be on the certificate. Since CAcert is an automated service, it discards most of the information on the certificate (so that it doesn't certify the information it is unable to verify), leaving only the essentials: the email address and the common name. Here is the information you will be asked for:

  • Country Name (use a two letter code e.g. GB)
  • State or Province Name (e.g. Surrey)
  • Locality Name (e.g. Guildford)
  • Organisational Name (e.g. Sam Hobbs' Personal Website)
  • Organisational Unit Name (e.g. Website)
  • Common Name (your domain name - see note below - e.g. samhobbs.co.uk)
  • Email Address (the contact address for your administrator e.g. webmaster@samhobbs.co.uk)

Don't set a password - leave it blank when asked. We will keep the key file private by setting appropriate permissions. The common name is important here: most websites rewrite https:// to https://www. or vice versa. If your website is available at https://yourdomain.com then you should use yourdomain.com as the common name; if your website is at https://www.yourdomain.com then your common name should be www.yourdomain.com or *.yourdomain.com (the wildcard will match any subdomain, meaning you can use the same cert for https://mail.yourdomain.com and https://www.yourdomain.com, which is handy). Personally, I use a wildcard certificate. If you were paying for a normal certificate authority to sign your certificate then a wildcard cert would be more expensive, but CAcert is of course free so you might as well take advantage of it!

Install the CAcert root certificate

Every operating system comes pre-loaded with a set of certificates that are seen as trusted by the OS. This includes certificates from verisign and other big name certificate signing authorities. Very few OSes trust CAcert by default, although a couple of Linux distributions do. The CAcert website provides https using a certificate that was signed by the CAcert root. Since you are going to be sending sensitive information to the website during registration, it makes sense to install the CAcert root certificate now so that you can use the site without browser errors. To install the CAcert root certificate from the commandline, you can use these commands:

cd ~
wget http://www.cacert.org/certs/root.txt
sudo cp root.txt /etc/ssl/certs/cacert-root.crt

Those commands will download the CAcert root certificate into your home directory, and then copy it to your certificates folder. If you look in your certs directory (ls -l /etc/ssl/certs) you will see that all of the certs have sensible certificate names like GeoTrust_Global_CA.pem, but there are also a load of symbolic links with names like 2c543cd1.0 that point to the certificate files with the human readable names. Those symlink names like 2c543cd1.0 are hashes of the certificate files, and are there to enable programs on your computer to quickly check whether the root certificate is in your computer's certificate directory or not. Some programs manage to recognise that the certificate is installed just fine without the symlinks, but some of them do not. Openssl is one of the ones that doesn't. So, we need to make use of one more command to create a symlink for the newly installed cacert-root.crt (this will also refresh the symlinks for the rest of the certs in the folder):

sudo c_rehash /etc/ssl/certs

Now that the CAcert root cert is installed, almost all software on your system will recognise it (chromium, rekonq etc.). The exception to this is Mozilla software such as the Firefox web browser and Thunderbird email client. Mozilla software has its own certificate database, which has both advantages and disadvantages. For example, if you're using a system where you don't have admin rights, you can still easily import the CAcert root to Firefox. The disadvantage is that if you are an administrator, you can't do a one-stop installation: you have to import it separately to Firefox. To install the certs, open Firefox and navigate to the root certificate downloads page and click on the links for the class 1 and class 3 .pem encoded root certificates. You will be prompted to decide whether to import them or not. To install to Android, follow this tutorial of mine.

Required Email Address

CAcert verifies that you own the domain it is signing a certificate for by sending a verification link to one of the following email addresses:

  • root@yourdomain.com
  • webmaster@yourdomain.com
  • postmaster@yourdomain.com

You therefore need to be able to receive email to one of these addresses. You can set up your own email server, or failing that some domain name registrars provide email forwarding capabilities. If you used my tutorials to set up your email server then you may want to add some aliases to your server so that emails to those addresses above are delivered to your username. Here's how: Edit /etc/aliases and add:

postmaster: yourusername
webmaster: yourusername
root: yourusername

Now run this command to load the new aliases:

sudo newaliases

And reload Postfix:

sudo service postfix reload

Submitting the CSR to CAcert

First things first, you will need to go to the CAcert website and create an account: Please note that CAcert has signed its own SSL certificate, so your browser may throw an error if you haven't imported the root cert yet. cacert-registration.png After you have created your account and logged in, navigate to server certificates --> new. On your server, use cat to print the the Certificate Signing Request (CSR) you created earlier and then copy & paste it into the box:

cat <filename for the CSR>.csr

...and click submit. The result will be displayed on screen, and you will also be emailed the certificate. Copy and paste it into a file with the .crt extension, e.g. using nano:

sudo nano <path to your cert>.crt

...then CTRL+SHIFT+V to paste, CTRL+X, save when prompted. Note: the BEGIN CERTIFICATE and END CERTIFICATE lines are part of the cert, so copy those too!

Certificate File Locations

Assuming your certificates and key file are in your home directory, it's a good idea to move them to the proper locations

  • Your key file should be stored at /etc/ssl/private/samhobbs.key.
  • Your certificate file should be stored at /etc/ssl/certs/samhobbs.crt.
  • You can get rid of your CSR, or keep it for reference if you like.

Permissions & Ownership

Your key file is secret. It should be owned by root, and your permissions should be set so that only the root user can read and write to it. This command will set it to be owned by root:

sudo chown root:root /etc/ssl/private/samhobbs.key

And this command will set it so that only the root user can read and modify it:

sudo chmod 600 /etc/ssl/private/samhobbs.key

Most services like Apache, Postfix etc. require root privileges to start up. They read the certs when they start and store them in RAM, so that they can still use them when they drop to their normal users ( e.g. www-datafor Apache). Unlike your key file, your signed certificate file is not a secret (it is sent to users when establishing a secure session). You want all users to be able to read the cert, but only the root user to have write access to it. As before, this command will set it to be owned by root:

sudo chown root:root /etc/ssl/certs/samhobbs.crt

And this command will set it to be readable by everyone, but only modified by root:

sudo chmod 644 /etc/ssl/certs/samhobbs.crt

Some common SSL cert configuration parameters: Apache, Postfix, Dovecot

This section is a quick reference for where to find SSL parameters for Apache, Postfix and Dovecot.

Apache

You can tell Apache to use a specific certificate file in your SSL virtualhost configuration (e.g /etc/apache2/sites-available/default-ssl) with these parameters:

SSLEngine on
SSLCertificateFile /etc/ssl/certs/samhobbs.crt
SSLCertificateKeyFile /etc/ssl/private/samhobbs.key

Then reload Apache:

sudo service apache2 reload

Postfix

Postfix' SSL cert configuration can be found in /etc/postfix/main.cf:

smtpd_tls_cert_file=/etc/ssl/certs/samhobbs.crt
smtpd_tls_key_file=/etc/ssl/private/samhobbs.key

...and reload Postfix:

sudo service postfix reload

Dovecot

Dovecot's SSL configuration is in /etc/dovecot/conf.d/10-ssl.conf:

ssl_cert = </etc/ssl/certs/samhobbs.crt
ssl_key = </etc/ssl/private/samhobbs.key

NB: the < at the start of the path isn't an error, if you miss it out Dovecot won't load. Reload dovecot:

sudo service dovecot reload

Hopefully you found that useful! If you have anything to add or a question, please feel free to leave a comment!

Comments

So I cecked the email log and when I try to setup a account on CAcert I get this output:

Oct 7 08:33:32 raspberrypi postfix/smtpd[12821]: connect from www.cacert.org[213.154.225.245]
Oct 7 08:33:32 raspberrypi postfix/smtpd[12821]: lost connection after STARTTLS from www.cacert.org[213.154.225.245]
Oct 7 08:33:32 raspberrypi postfix/smtpd[12821]: disconnect from www.cacert.org[213.154.225.245] ehlo=1 starttls=1 commands=2

As I read it... just my noob opinion. The cert from CAcert is not trusted by my raspberry pi. Although I did add the cert to the root of my Pi.

What do you think?

What happens if you set postfix to use the new cert you just generated with your actual domain name instead of the snakeoil cert? I am wondering if cacert aborts the connection because the common name on the cert is "raspberrypi" or something. Sam

I don't know Sam. But a of this morning my mail server can't send e-mail or recieve any.... It's the third time now I had to set it al up again from scratch and had lot of fun doing it, but right now it is taking up to much time. Sadly Iám goging back to data hungery Google G-mail. Its a neccerciary evil I guess. Sam thanks for you help!

Well one thing I have not considderd is that my IPS also uses IPv6. I also have a static IPv4 adress that is configured in my DNS. My IPv6 however is not. I will try to add my IPv6 to the DNS. I will let you know.

Sam, I have used letsencrypt en it works like a charm.
Basicly you use certbot and optain a cert via the internal webserver of certbot. For this you need to stop the Apache2 server.
Then you get your cert and you can configure it in apache, postfix and dovecot.
I followed the following site: https://pimylifeup.com/raspberry-pi-ssl-lets-encrypt/
And then used your tutorial.
Only thing is you need to renew the cert every 3 months or so.

Johnny Calderon

Mon, 01/21/2019 - 04:50

So I've been following the tutorial step by step, however there are a couple of things I can't figure out, 1. I can't connect to the email account from an email client, when I use my outlook android app it says: the certificate is invalid do you still want to login?, if I agree still the account can't send or receive messages.
2. When I try to create an account in CACert, it keeps failing to make a connection to the mail server
So I'm a little confused, I do have a domain name and I can login with openssl on 993 from a remote device outside my LAN, for once I think the problem lies in the certificate but then CACert can't connect to my server so not sure where I've gone wrong, any tip would be appreciated. Thanks!

André Ardon

Tue, 02/26/2019 - 19:59

Hi Sam,
Many thanks for your awasome howto's.
i've use the mailserver howto and now upgraded my cert's with your CAcert howto.

i think if found a smal typo (the only one in all i've copy-pasted from your howto's):
in :
Apache
You can tell Apache to use a specific certificate file in your SSL virtualhost configuration (e.g /etc/apache2/sites-available/default-ssl) with these parameters:

it looks like we need to modify /etc/apache2/sites-available/default-ssl.conf.

Again nice work, and a big THANK YOU

Hi Andre, Thanks for pointing that out. They renamed the config files in newer versions of Debian! Glad the tutorials have been useful to you. Sam

Hi Sam,

I've spent days pouring over your tutorials, and I now have everything (pretty much) set up and working the way I need it. Your tutorials are first-rate; it's taken me a while to work through them, mostly because of my ineptitude, or because i'm on Raspbian stretch and/or aspects of my system are just, well, different.

I'm struggling with registering my domain with CAcert - but I think this is a grey-listing issue with no-ip.com. I'll be getting a proper domain name and static IP address soon enough, so that's not my main problem.

My real issue is with Squirrelmail, as per your 3rd tutorial. The minute I enabled SSL access, I could no longer reach Squirrelmail externally over the internet via my domain. So, I can access https://192.168.xxx.xxx/squirrelmail, but not https://mydomain.com/squirrelmail.

Have I missed a step, and/or would you know what (presumably simple) setting I need to tweak?

Thanks so much if you can help me out with this; and thanks for the great tutorials.

Steven.

I am having issues getting the certs sent from cacert.org. I get the same error message stating that my email address is invalid or the mail was rejected. I can see the incoming message in my mail.log, but it goes as follows:

Feb 22 03:50:30 email postfix/smtpd[10312]: connect from www.cacert.org[213.154.225.245]
Feb 22 03:50:30 email postfix/smtpd[10312]: lost connection after UNKNOWN from www.cacert.org[213.154.225.245]
Feb 22 03:50:30 email postfix/smtpd[10312]: disconnect from www.cacert.org[213.154.225.245] unknown=0/1 commands=0/1

I have tested out two other mail services (gmail.com and juno.com) which are both capable of sending messages successfully. Might you have any insight as to why this could be happening?

Thank you very much for these tutorials, and for responding to everyone's troubleshooting questions.

Add new comment

The content of this field is kept private and will not be shown publicly.

Filtered HTML

  • Web page addresses and email addresses turn into links automatically.
  • Allowed HTML tags: <a href hreflang> <em> <strong> <cite> <blockquote cite> <code> <ul type> <ol start type> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.