mirror of
https://github.com/dehydrated-io/dehydrated.git
synced 2026-01-13 15:13:33 +01:00
EC PARAMETERS in privkey.pem break postfix smtpd_tls_chain_file #423
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jcastle-gh on GitHub (Jul 25, 2019).
The privkey.pem contains an EC PARAMETERS pem object followed by the EC PRIVATE KEY pem object. The EC PARAMETERS object is unnecessary because it just contains the name of the standard curve which is already encoded in the key itself. Most software ignores the parameters object but some doesn't and breaks.
For example, in postfix before version 3.4 the EC key file is set in the "smtpd_tls_eckey_file" variable and it is read using SSL_CTX_use_PrivateKey_file() which skips over and discards the EC PARAMETERS object. But postfix 3.4 added a new "smtpd_tls_chain_files" variable which sets all the various key and cert files in one variable, and then postfix reads the files using different code that doesn't tolerate EC PARAMETERS and throws an error:
Adding a "-noout" switch to the "ecparam -genkey" command tells it not to output the unnecessary EC PARAMETERS object. The resulting key file works with software that would have tolerated it and with the new postfix which does not.
Here's a patch.
ec_noout_patch.txt
@jcastle-gh commented on GitHub (Jul 25, 2019):
For background, here are some links that led me to this solution as I was digging down.
An OpenSSL wiki suggesting using -noout to get rid of the EC parameters:
trent.utfs.org wiki
A stack exchange post referenced above explaining what's going on:
security.stackexchange.com
@lukas2511 commented on GitHub (Oct 4, 2019):
You can simply convert / strip / whatever the certificate using a
deploy_certhook. There is no need to do this in dehydrated itself.@jcastle-gh commented on GitHub (Oct 19, 2019):
No software should need the EC PARAMETERS block, as I explained above, and the fix is very straightforward: add a "-noout" command line switch in one openssl call. But instead you're no-fixing it and choosing not to interoperate with a widely used application, and expecting users to figure out the unexpected error and hack around it in a hook script? With respect, that seems like a bad call to me.
Of course it is your call though, so I'll move on.
Dehydrated is nice work and it's working well for me. Thanks for making it.
@TokisanGames commented on GitHub (Jun 24, 2021):
For posterity and people searching for Postfix errors, just edit your key file, which looks something like this:
Remove the whole
ec parametersblock, save, restart postfix and any other software that references it. No need to regenerate the key and certificates.@lukas2511 commented on GitHub (Oct 31, 2021):
EC PARAMETERShave been removed@someone-somenet-org commented on GitHub (Jul 30, 2024):
The
-----BEGIN EC PARAMETERS-----block is still there,Dehydrated version: 0.7.0as packaged on debian stable+backports.@AgentOak commented on GitHub (Jul 30, 2024):
@someone-somenet-org As you can tell by reading the changelog EC parameters has been removed in 0.7.1.
Debian is a point release distribution, i.e. software versions remain fixed, only security and important bugfixes are applied in between Debian releases. If you believe this bug is important enough to get a fix in the stable release you would have to ask on the Debian bugtracker.