Forum Debian Users Gang

cat /usr/local/bin/dovecot-mkcert
#!/bin/sh

# Generates a self-signed certificate.
# Edit dovecot-openssl.cnf before running this.

umask 077
OPENSSL=${OPENSSL-openssl}
SSLDIR=${SSLDIR-/etc/ssl}
OPENSSLCONFIG=/etc/ssl/dovecot-openssl.cnf

CERTDIR=$SSLDIR/certs
KEYDIR=$SSLDIR/private

CERTFILE=$CERTDIR/dovecot.pem
KEYFILE=$KEYDIR/dovecot.pem

if [ ! -d $CERTDIR ]; then
  echo "$SSLDIR/certs directory doesn't exist"
  exit 1
fi

if [ ! -d $KEYDIR ]; then
  echo "$SSLDIR/private directory doesn't exist"
  exit 1
fi

if [ -f $CERTFILE ]; then
  echo "$CERTFILE already exists, won't overwrite"
  exit 1
fi

if [ -f $KEYFILE ]; then
  echo "$KEYFILE already exists, won't overwrite"
  exit 1
fi

openssl req -new -x509 -nodes -config $OPENSSLCONFIG -out $CERTFILE -keyout $KEYFILE -days 3650 || exit 2
chmod 0600 $KEYFILE
echo 
openssl x509 -subject -fingerprint -noout -in $CERTFILE || exit 2

cat /etc/ssl/dovecot-openssl.cnf
[ req ]
default_bits = 2048
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no

[ req_dn ]
# country (2 letter code)
C=PL

# State or Province Name (full name)
#ST=

# Locality Name (eg. city)
L=Miejscowość

# Organization (eg. company)
O=Firma

# Organizational Unit Name (eg. section)
OU=IMAP server

# Common Name (*.example.com is also possible)
CN=poczta.firma.pl

# E-mail contact
emailAddress=postmaster@firma.pl

[ cert_type ]
nsCertType = server[/cat]

Przeczytałam, że trzeba zrobić jeszcze coś takiego:
openssl dhparam -out /etc/dovecot/dh.pem 4096

$config['default_host'] = 'ssl://poczta.firma.pl'; //your imap server address

$config['imap_conn_options'] = array(
        'ssl' => array(
            'verify_peer'       => true,
            'allow_self_signed' => true,
            'peer_name'         => 'poczta.firma.pl',
            'ciphers'           => 'TLSv1+HIGH:!aNull:@STRENGTH',
            'cafile'            => '/etc/ssl/certs/dovecot.pem',
        ),
    );

$config['smtp_conn_options'] = array(
        'ssl' => array(
            'verify_peer'       => true,
            'allow_self_signed' => true,
            'peer_name'         => 'poczta.firma.pl',
            'ciphers'           => 'TLSv1+HIGH:!aNull:@STRENGTH',
            'cafile'            => '/etc/ssl/certs/dovecot.pem',
        ),
    );