6 ms·

I switched to letsencrypt certs for my imap server. Works well, IMO better than the self-signed ones I used before.

• mmd45 2y ago
  I'm using a private ip over a vpn so I don't think that workaround will work for me. I don't really want a public dns record.
  • Arnt 2y ago
    LE will issue you a wildcard certificate and it's usable for mail.
    • mmd45 2y ago
      i'm just using a hardcoded private ip to connect to the imap server. are you saying i can get a certificate with a hostname of "*" that will match ANY ip address?
      • oneplane 2y ago
        No, but you could use DNS for that internal IP. And then you'd have a hostname. Since your IMAP server likely has some way of getting external mail, it is likely that you have a DNS zone and MX records, so adding an A record for your internal IMAP access isn't that much of an effort compared to what you already would have. If you have mmd45.com as a domain and have MX records pointing to your mail server, adding imap.mmd45.com pointing to your IMAP server should be fairly simple. Getting a Let's Encrypt certificate for *.mmd45.com is all that remains for the TLS part with a valid CA chain. As a bonus you can then also use encrypted SMTP.
        • mmd45 2y ago
          unfortunately none of that applies to my setup. my imap server lives in a dmz and doesn't have all that other jazz.
          • 0x457 2y ago
            Only thing required for this setup to work: client needs to be able to resolve domain to internal ip. I have wireguard mesh with a bunch of services that use LE for TLS that have no access to interwebs and not accessible from interwebs.
            • mmd45 2y ago
              how are you renewing the LE certificate if the domain is resolving to an internal ip? this seems like a big hoop to jump through.
              • greyface- 2y ago
                https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen...
              • Arnt 2y ago
                LE doesn't need any A or AAAA record. The domain must exist in the DNS and you must be able to create records in the domain. If you're using internet mail you have a domain, so you can do this. The time for self-signed certificates has passed.
                • kortilla 2y ago
                  A pinned self cert is still more secure than this because you don’t have to trust any CAs. > The time for self-signed certificates has passed. This is bad blanket advice and very much depends on use-case.
                  • Arnt 2y ago
                    Software is a collective. A billion or so people get the same software. The time for self-signed certs has passed because supporting that in software for a billion people opens up some of that billion to attack. The few people who understand the niceties of certs can create a private CA, trust that, and use that CA to sign a regular cert. Doing that is nontrivial, but it doesn't put other people at risk.
  • cpach 2y ago
    If so, then you might want to mint your own root certificate and then import it to your iPhone.
• ytch 2y ago
  ACME DNS-01 Challenge doesn't need a public resolvable and reachable host, it just sets a temporary DNS record to verify.
• hedora 2y ago
  That adds a lot of attack surface vs. issuing a self-signed cert and confirming it was securely verified by your imap client. Not only could let’s encrypt issue a mitm cert for your imap connections, so could other CAs, and any cloud providers / dns providers you use.
  • commandersaki 2y ago
    Uh what is a mitm cert? You're the custodian of the private key associated with the certificate, not LetsEncrypt. And any CA can generate a certificate to MITM anything. That's why it's pretty much a requirement to submit all certs issued to Certificate Transparency, and if you're found to be misbehaving expect to receive ire from CA/B.
    • beeflet 2y ago
      why should I require some third party's permission to do encryption between one of my computers and another one of my computers?
      • kijin 2y ago
        Because you chose to use a program that doesn't accept self-signed certificates. Use a different program or a different computer that actually respects your freedom to tinker with it. Problem solved.
        • DidYaWipe 2y ago
          No. He noted that it's a REGRESSION. So he chose one that DID accept them. Running away from defects doesn't get them fixed.
          • Arnt 2y ago
            Self-signed certs were a defect — people were used to just click OK and blackhats exploited that. OP wants support for the special case where only the cert issuer trusts the cert (he has his own self-signed cert). Apple and others do support that: You make a private CA, trust that CA in the device, and then use that CA to sign certs for your IMAP server. IIRC (and this is from vague memory) you may need to configure yourself to be a company that manages employees' devices.