Re: cleaning up courier-* packages

> We need a starting point anyway, so let's try different scenarios,
> hardcoding command in spec file first. We can use courier-imap as a test
> package, ssl certs handling have been removed from initscripts anyway :)
> 
> Here is a simple auto-signed certs generation scenario:
> 1) ship ssl upstream cert configuration file as /etc/pki/tls/imap.cnf,
> tagged as configuration files
> 2) generate self-signed certificate in %post in initial installation only:
> openssl req -new -x509 -days 365 -config /etc/pki/tls/imap.cnf -keyout
> /etc/pki/tls/private/imap.pem -out /etc/pki/tls/certs/imap.pem
How about making the cert with:
-days 3650
> 
> Sysadmin could just replace /etc/pki/tls/imap.cnf with its own one, and
> use it as he want thereafter, without troubles during following upgrades.
> 
> This is achievable right now, and could already benefit from
> standardising all our ssl-dependant packages.
> 
> A more complexe would be:
> 1) ship ssl upstream cert configuration file as /etc/pki/tls/imap.cnf
> 2) generate certificate request in %post:
> openssl req -new -config /etc/pki/tls/imap.cnf -keyout
> /etc/pki/tls/private/imap.pem -out /etc/pki/tls/req/imap.pem
> 3) generate crl in %post:
> ?
> 4) sign them using local CA:
> openssl ca -in /etc/pki/tls/req/imap.pem -out /etc/pki/tls/certs/imap.pem
Sounds like the same procedure for setting up SSL/TLS on postfix.
> 
> However, this is likely to require CA key passphrase, which would
> prevent non-interactive installation, unless we have the passphrase
> stored somewhere. This reminds me about automatic database creation on
> installation discussions :/



-- 
Regards
--------------------------------------
Gerald Drouillard
Technology Architect
Drouillard & Associates, Inc.
http://www.Drouillard.ca