Certificado do servidor autoassinado para o TLS do Postfix

Question

Estou tentando criar o certificado do servidor auto-assinado para o usuário do Postfix:

thufir@dur:~$ 
thufir@dur:~$ sudo ./tls.script 
Error opening Private Key 
3073578684:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('','r')
3073578684:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load Private Key
thufir@dur:~$ 
thufir@dur:~$ nl tls.script 
     1  # dir="$(postconf -h config_directory)"
     2  # fqdn=$(postconf -h myhostname)
     3  # case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
     4  # ymd=$(date +%Y-%m-%d)
     5  # key="${dir}/key-${ymd}.pem"; rm -f "${key}"
     6  # cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
     7  # (umask 077; openssl genrsa -out "${key}" 2048) &&
     8    openssl req -new -key "${key}" \
     9      -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
    10    postconf -e \
    11      "smtpd_tls_cert_file = ${cert}" \
    12      "smtpd_tls_key_file = ${key}"

thufir@dur:~$ 

de acordo com o início rápido do Postfix no TLS .

thufir@dur:~$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
default_transport = error
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command =
mailbox_size_limit = 0
mailman_destination_recipient_limit = 1
mydestination = dur.bounceme.net, localhost.bounceme.net, localhost
myhostname = dur.bounceme.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relay_domains = lists.dur.bounceme.net
relay_transport = error
relayhost =
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_loglevel = 2
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
thufir@dur:~$ 

Preciso executar o script de um determinado local? Eu estava apenas usando o meu diretório pessoal, com o sudo.

Aliás, eu estaria ok com o uso do certificado de óleo de cobra .

    

Answer 1

Corrigido o problema usando a resposta útil de muru em um comentário .

% bl0ck_qu0te%

thufir@dur:~$ 
thufir@dur:~$ sudo ./tls.script 
[sudo] password for thufir: 
Generating RSA private key, 2048 bit long modulus
....................................................................+++
.........................................+++
e is 65537 (0x10001)

O conteúdo de tls.script deve ser assim (sem as marcas iniciais # como na pergunta)

    dir="$(postconf -h config_directory)"
    fqdn=$(postconf -h myhostname)
    case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
    ymd=$(date +%Y-%m-%d)
    key="${dir}/key-${ymd}.pem"; rm -f "${key}"
    cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}"
    (umask 077; openssl genrsa -out "${key}" 2048) &&
     openssl req -new -key "${key}" \
       -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" &&
    postconf -e \
      "smtpd_tls_cert_file = ${cert}" \
      "smtpd_tls_key_file = ${key}"