Public Key Infrastructure (PKI)
===============================

Hosts
-----
Host certificates can be either self-signed or signed by a CA. The
private key can be either embedded into the same file as the certificate 
or in a separate file.

The simplest form is a self-signed certificate with null-password 
embedded key.

Beware that passwords for host certificates usually means you will need
to manually start the services.

Self-signed host certificates contain both certificate and key in same
file. The file is placed in /etc/ssl/certs/ named by the service it
provides appended ".pem".

CA signed host certificates have separate public (certificate) and
private (key) parts. The certificate is located as with self-signed
ones, and keys are placed in /etc/ssl/private/ named similarly.

The script /usr/share/local/localmksslcerts can be used to make
self-signed certificates with embedded keys.

Certificates should be chmod'ed 0444 and keys 0400.

Certificate Authority
---------------------
CA Certificates are divided in a public certificate and a private key.

The CA certificate is placed in /etc/ssl/certs/ and named loosely by the
CN of the organisation using digits [a-zA-Z0-9_-], appended "_CA.crt".

Example: IT_guide_dr_Jones_CA.pem

CA key is located in /etc/ssl/private/ equally named.

Certificate is symlinked to "/etc/ssl/certs/cacert.pem" for easy
locating by scripts.

More info here: http://tirian.magd.ox.ac.uk/~nick/openssl-certs/ca.shtml

Read here about confusion between commercial CAs and actual security:
http://www.counterpane.com/pki-risks.html

Like with hosts, certificates should be chmod'ed 0444 and keys 0400.

Users
-----
Have a look at this web page:
http://www.cise.ufl.edu/help/secure-access/ssl-mail-setup.shtml

The script is at /usr/share/local/mycert, adapted to Debian GNU/Linux.

-- 
$Id: Certificates.txt,v 1.3 2002-12-31 02:31:21 jonas Exp $
932.i919Wk22060119@opendk.veriovps.co.uk/inbox'>
<input type='hidden' name='h' value='master'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/notmuch/diff/?h=master'>root</a>/<a href='/notmuch/diff/tags?h=master'>tags</a>/<a href='/notmuch/diff/tags/80?h=master'>80</a>/<a href='/notmuch/diff/tags/80/ef?h=master'>ef</a>/<a href='/notmuch/diff/tags/80/ef/200410010932.i919Wk22060119@opendk.veriovps.co.uk?h=master'>200410010932.i919Wk22060119@opendk.veriovps.co.uk</a>/<a href='/notmuch/diff/tags/80/ef/200410010932.i919Wk22060119@opendk.veriovps.co.uk/inbox?h=master'>inbox</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='h' value='master'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><div class='diffstat-header'><a href='/notmuch/diff/?h=master'>Diffstat</a> (limited to 'tags/80/ef/200410010932.i919Wk22060119@opendk.veriovps.co.uk/inbox')</div><table summary='diffstat' class='diffstat'><tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/80/ef/200410010932.i919Wk22060119@opendk.veriovps.co.uk/inbox?h=master'>tags/80/ef/200410010932.i919Wk22060119@opendk.veriovps.co.uk/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
</table><div class='diffstat-summary'>1 files changed, 0 insertions, 0 deletions</div><table summary='diff' class='diff'><tr><td>-nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/debian?h=master'>tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/debian</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/jones?h=master'>tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/jones</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/sent?h=master'>tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/sent</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/signed?h=master'>tags/af/bb/20141026203829.15411.63399@bastian.jones.dk/signed</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20170314110002.6C0D4587@lxp5.free-owl.de/sys?h=master'>tags/af/bb/20170314110002.6C0D4587@lxp5.free-owl.de/sys</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20170314110002.6C0D4587@lxp5.free-owl.de/unread?h=master'>tags/af/bb/20170314110002.6C0D4587@lxp5.free-owl.de/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20180507030219.1393A1C179@jawa.homebase.dk/hb?h=master'>tags/af/bb/20180507030219.1393A1C179@jawa.homebase.dk/hb</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20180507030219.1393A1C179@jawa.homebase.dk/sys?h=master'>tags/af/bb/20180507030219.1393A1C179@jawa.homebase.dk/sys</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/20180507030219.1393A1C179@jawa.homebase.dk/unread?h=master'>tags/af/bb/20180507030219.1393A1C179@jawa.homebase.dk/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/2072450285.625786.1476476749820@mail.yahoo.com/attachment?h=master'>tags/af/bb/2072450285.625786.1476476749820@mail.yahoo.com/attachment</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/2072450285.625786.1476476749820@mail.yahoo.com/inbox?h=master'>tags/af/bb/2072450285.625786.1476476749820@mail.yahoo.com/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/2072450285.625786.1476476749820@mail.yahoo.com/old?h=master'>tags/af/bb/2072450285.625786.1476476749820@mail.yahoo.com/old</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/debian?h=master'>tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/debian</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/inbox?h=master'>tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/killed?h=master'>tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/killed</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/unread?h=master'>tags/af/bb/E1je2nM-000G6k-6g@fasolo.debian.org/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/YGdPsRSnFuIwwrD0@taz.net.au/debian?h=master'>tags/af/bb/YGdPsRSnFuIwwrD0@taz.net.au/debian</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/YGdPsRSnFuIwwrD0@taz.net.au/unread?h=master'>tags/af/bb/YGdPsRSnFuIwwrD0@taz.net.au/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/handler.929243.D929243.15979787183348.ackdone@bugs.debian.org/debian?h=master'>tags/af/bb/handler.929243.D929243.15979787183348.ackdone@bugs.debian.org/debian</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/handler.929243.D929243.15979787183348.ackdone@bugs.debian.org/killed?h=master'>tags/af/bb/handler.929243.D929243.15979787183348.ackdone@bugs.debian.org/killed</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/af/bb/handler.929243.D929243.15979787183348.ackdone@bugs.debian.org/unread?h=master'>tags/af/bb/handler.929243.D929243.15979787183348.ackdone@bugs.debian.org/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
</table><div class='diffstat-summary'>24 files changed, 0 insertions, 0 deletions</div><table summary='diff' class='diff'><tr><td>