# cd /etc/ssl/private
# openssl genrsa -des3 -out server.key 2048
Generating RSA private key, 2048 bit long modulus
..................................+++
.......................................................+++
e is 65537 (0x10001)
Enter pass phrase for server.key: # <= サーバ証明書用パスワード設定
Verifying - Enter pass phrase for server.key: # <= サーバ証明書用パスワード確認入力
# openssl rsa -in server.key -out server.key
Enter pass phrase for server.key: # <= サーバ証明書用パスワード応答
writing RSA key
# openssl req -new -days 3650 -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP # <= 国の略名
State or Province Name (full name) [Some-State]:Shimane # <= 都道府県名
Locality Name (eg, city) []:Matsue # <= 市区町村名
Organization Name (eg, company) [Internet Widgits Pty Ltd]:mk-mode.com # <= サイト名(何でもよい)
Organizational Unit Name (eg, section) []: # <= 部署名(空でよい)
Common Name (e.g. server FQDN or YOUR name) []:www.mk-mode.com # <= ホスト名
Email Address []:webmaster@mk-mode.com # <= 管理者メールアドレス
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: # <= 追加属性・空エンターでよい
An optional company name []: # <= 追加属性・空エンターでよい
# openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650
Signature ok
subject=/C=JP/ST=Shimane/L=Matsue/O=mk-mode.com/CN=www.mk-mode.com/emailAddress=webmaster@mk-mode.com
Getting Private key
# chmod 400 server.*
# /etc/init.d/postfix restart
Stopping Postfix Mail Transport Agent: postfix.
Starting Postfix Mail Transport Agent: postfix.
# /etc/init.d/dovecot restart
Restarting IMAP/POP3 mail server: dovecot.
6. ファイアウォール(iptables)設定
実際に運用する場合は、ポートを開放する必要がある。
File: /etc/iptables/rules.v4
1# 外部からのTCP465番ポート(SMTPS)へのアクセスを許可2 -A INPUT -p tcp --dport 465 -j ACCEPT
34# 外部からのTCP995番ポート(POP3S)へのアクセスを許可5 -A INPUT -p tcp --dport 995 -j ACCEPT
67# 外部からのTCP993番ポート(IMAPS)へのアクセスを許可8 -A INPUT -p tcp --dport 993 -j ACCEPT
そして、設定を反映させるために iptables-persistent を再起動する。
12
# /etc/init.d/iptables-persistent restart
Loading iptables rules... IPv4... skipping IPv6 (no rules to load)...done.