forked from pool/dovecot23
Dirk Mueller
c70acd27d4
- Fix dovecot-2.3.0-dont_use_etc_ssl_certs.patch: Align the certificate path/filenames to /etc/ssl/private/*.crt, which happens to match what the patch also does for mkert.sh (boo#1193909). - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/950732 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=101
123 lines
5.2 KiB
Diff
123 lines
5.2 KiB
Diff
Index: dovecot-2.3.17.1/doc/man/doveconf.1.in
|
|
===================================================================
|
|
--- dovecot-2.3.17.1.orig/doc/man/doveconf.1.in
|
|
+++ dovecot-2.3.17.1/doc/man/doveconf.1.in
|
|
@@ -136,7 +136,7 @@ Show passwords and other sensitive value
|
|
.TP
|
|
.B \-x
|
|
Expand configuration variables (e.g. \(Domail_plugins \(rA quota) and show
|
|
-file contents (from e.g. ssl_cert = </etc/ssl/certs/dovecot.pem).
|
|
+file contents (from e.g. ssl_cert = </etc/ssl/private/dovecot.crt).
|
|
.\"---------------------------------
|
|
.TP
|
|
.I section_name
|
|
@@ -217,4 +217,4 @@ dict/quota = pgsql:@pkgsysconfdir@/dovec
|
|
.BR doveadm (1),
|
|
.BR dovecot (1),
|
|
.BR dovecot\-lda (1),
|
|
-.BR dsync (1)
|
|
\ No newline at end of file
|
|
+.BR dsync (1)
|
|
Index: dovecot-2.3.17.1/doc/mkcert.sh
|
|
===================================================================
|
|
--- dovecot-2.3.17.1.orig/doc/mkcert.sh
|
|
+++ dovecot-2.3.17.1/doc/mkcert.sh
|
|
@@ -8,14 +8,14 @@ OPENSSL=${OPENSSL-openssl}
|
|
SSLDIR=${SSLDIR-/etc/ssl}
|
|
OPENSSLCONFIG=${OPENSSLCONFIG-dovecot-openssl.cnf}
|
|
|
|
-CERTDIR=$SSLDIR/certs
|
|
+CERTDIR=$SSLDIR/private
|
|
KEYDIR=$SSLDIR/private
|
|
|
|
-CERTFILE=$CERTDIR/dovecot.pem
|
|
+CERTFILE=$CERTDIR/dovecot.crt
|
|
KEYFILE=$KEYDIR/dovecot.pem
|
|
|
|
if [ ! -d $CERTDIR ]; then
|
|
- echo "$SSLDIR/certs directory doesn't exist"
|
|
+ echo "$CERTDIR directory doesn't exist"
|
|
exit 1
|
|
fi
|
|
|
|
Index: dovecot-2.3.17.1/doc/wiki/CompilingSource.txt
|
|
===================================================================
|
|
--- dovecot-2.3.17.1.orig/doc/wiki/CompilingSource.txt
|
|
+++ dovecot-2.3.17.1/doc/wiki/CompilingSource.txt
|
|
@@ -142,7 +142,7 @@ non-standard path. Make sure you have th
|
|
installed, and if it is not in the standard location, set 'CPPFLAGS' and
|
|
'LDFLAGS' as shown in <the first section above.> [CompilingSource.txt]
|
|
|
|
-By default the SSL certificate is read from '/etc/ssl/certs/dovecot.pem' and
|
|
+By default the SSL certificate is read from '/etc/ssl/private/dovecot.crt' and
|
|
the private key from '/etc/ssl/private/dovecot.pem'. The '/etc/ssl' directory
|
|
can be changed using the '--with-ssldir=DIR' configure option. Both can of
|
|
course be overridden from the configuration file.
|
|
Index: dovecot-2.3.17.1/doc/wiki/SSL.CertificateCreation.txt
|
|
===================================================================
|
|
--- dovecot-2.3.17.1.orig/doc/wiki/SSL.CertificateCreation.txt
|
|
+++ dovecot-2.3.17.1/doc/wiki/SSL.CertificateCreation.txt
|
|
@@ -39,7 +39,7 @@ CN matches the connected host name, othe
|
|
invalid. It's also possible to use wildcards (eg. *.domain.com) in the host
|
|
name. They should work with most clients.
|
|
|
|
-By default the certificate is created to '/etc/ssl/certs/dovecot.pem' and the
|
|
+By default the certificate is created to '/etc/ssl/private/dovecot.crt' and the
|
|
private key file is created to '/etc/ssl/private/dovecot.pem'. Also by default
|
|
the certificate will expire in 365 days. If you wish to change any of these,
|
|
modify the mkcert.sh script.
|
|
Index: dovecot-2.3.17.1/doc/wiki/SSL.DovecotConfiguration.txt
|
|
===================================================================
|
|
--- dovecot-2.3.17.1.orig/doc/wiki/SSL.DovecotConfiguration.txt
|
|
+++ dovecot-2.3.17.1/doc/wiki/SSL.DovecotConfiguration.txt
|
|
@@ -41,7 +41,7 @@ The most important SSL settings are (in
|
|
---%<-------------------------------------------------------------------------
|
|
ssl = yes
|
|
# Preferred permissions: root:root 0444
|
|
-ssl_cert = </etc/ssl/certs/dovecot.pem
|
|
+ssl_cert = </etc/ssl/private/dovecot.crt
|
|
# Preferred permissions: root:root 0400
|
|
ssl_key = </etc/ssl/private/dovecot.pem
|
|
---%<-------------------------------------------------------------------------
|
|
@@ -73,11 +73,11 @@ override the global setting.:
|
|
|
|
---%<-------------------------------------------------------------------------
|
|
protocol imap {
|
|
- ssl_cert = </etc/ssl/certs/imap.pem
|
|
+ ssl_cert = </etc/ssl/private/imap.crt
|
|
ssl_key = </etc/ssl/private/imap.pem
|
|
}
|
|
protocol pop3 {
|
|
- ssl_cert = </etc/ssl/certs/pop3.pem
|
|
+ ssl_cert = </etc/ssl/private/pop3.crt
|
|
ssl_key = </etc/ssl/private/pop3.pem
|
|
}
|
|
---%<-------------------------------------------------------------------------
|
|
@@ -194,11 +194,11 @@ support SNI.
|
|
|
|
---%<-------------------------------------------------------------------------
|
|
local_name imap.example.org {
|
|
- ssl_cert = </etc/ssl/certs/imap.example.org.crt
|
|
+ ssl_cert = </etc/ssl/private/imap.example.org.crt
|
|
ssl_key = </etc/ssl/private/imap.example.org.key
|
|
}
|
|
local_name imap.example2.org {
|
|
- ssl_cert = </etc/ssl/certs/imap.example2.org.crt
|
|
+ ssl_cert = </etc/ssl/private/imap.example2.org.crt
|
|
ssl_key = </etc/ssl/private/imap.example2.org.key
|
|
}
|
|
# ..etc..
|
|
Index: dovecot-2.3.17.1/doc/example-config/conf.d/10-ssl.conf
|
|
===================================================================
|
|
--- dovecot-2.3.17.1.orig/doc/example-config/conf.d/10-ssl.conf
|
|
+++ dovecot-2.3.17.1/doc/example-config/conf.d/10-ssl.conf
|
|
@@ -9,7 +9,7 @@
|
|
# dropping root privileges, so keep the key file unreadable by anyone but
|
|
# root. Included doc/mkcert.sh can be used to easily generate self-signed
|
|
# certificate, just make sure to update the domains in dovecot-openssl.cnf
|
|
-ssl_cert = </etc/ssl/certs/dovecot.pem
|
|
+ssl_cert = </etc/ssl/private/dovecot.crt
|
|
ssl_key = </etc/ssl/private/dovecot.pem
|
|
|
|
# If key file is password protected, give the password here. Alternatively
|