Anyone ran into TLS issues with Mail?

[Anonymous]

I cannot enable SSL for Mail. It won’t work with the default even, that is created by the system during install of Tiger, this appears in the logs:

May 1 11:33:43 mail imaps[639]: accepted connection
May 1 11:33:43 mail imaps[639]: TLS server engine: cannot load CA data
May 1 11:33:43 mail imaps[639]: unable to get private key from ‘/etc/certificates/Default.key’

For the “signed” certificate, it does the same thing:

May 1 11:28:41 mail imaps[553]: unable to get private key from ‘/etc/certificates/XXXXXXXXX.key’
May 1 11:28:41 mail imaps[553]: TLS server engine: cannot load cert/key data

Any ideas?

[Oneota]

I’m running into the same thing. I’m relatively sure my DNS is up and running properly, and that I’ve created my self-signed certs properly, but mail just doesn’t wanna use ’em.

I followed the steps demo’d in the WWDC session exactly, as near as I can tell, but am not getting the same results.

[Anonymous]

Yes I have the same problem and have been able to get a temporary workaround in place.

For some reason my key file is owned by group “29”

-rw-r–r– 1 root wheel 0 Jun 3 11:04 .defaultCertificateCreated
-rw-r–r– 1 root wheel 660 Jun 9 13:29 Default.crt
-rw-r—– 1 root 29 1547 Jun 9 13:29 Default.crtkey
-rw-r—– 1 root wheel 534 Jun 3 11:04 Default.csr
-rw-r—– 1 root 29 887 Jun 9 13:29 Default.key
-rw-r–r– 1 root wheel 875 Jun 23 11:55 kanga.lorannet.net.crt
-rw-r—– 1 root 29 1762 Jun 23 11:55 kanga.lorannet.net.crtkey
-rw-r—– 1 root wheel 643 Jun 13 10:07 kanga.lorannet.net.csr
-rw-r—– 1 root mail 887 Jun 23 11:55 kanga.lorannet.net.key
-rw-r–r– 1 root wheel 137141 Jun 18 23:20 x509anchors.pem

when I change the group to mail
chgrp mail kanga.lorannet.net.key

I am able to use TLS.

However, the ownership keeps getting set back to “29”

I would like to know who group 29, why I do not have group 29 (no serious hacking on groups) and why the ownership keeps moving back to “29”

[Anonymous]

ahaa,

This explains why I am also getting mail errors. my /etc/groups has the "cyrususers" with root,jabber,postfix,cyrusimap users

however "cyrususers" is not in WGM nor in netinfo.

In which directory does the group "cyrususers" go and how do you populate it with users?

This was a stock working 10.3.9 server that I upgraded to 10.4 and then to 10.4.1

I wounder what other users I am mising? I did not have diradmin before or afer the upgrade and that forced me to move the master server to stand-alone and then back to master where I re-entered all users by hand. Luckily, I only had a dozen

[Anonymous]

I solved the issue, permanently I hope

I added the group certusers to the mail servers netinfo directory. I had to add the following properties and values

users root, jabber, postfix, and cyrusimap
gid 29
password *
realname Certificate Users
name certusers

I could not figure out how to do a memberd cache flush so I rebooted and the problem was solved

[Author]

Posts