mail serverの移行（その43）Postfix、Dovecotの再構築

何だか、気が付いたらamavisdが落ちていた。
此れだとPostfixがメールのチェックに渡した途端コケる。
次から次へとミスが連鎖している気がする。

さて、気を取り直して直すことにする。
幾つかのサイトを辿って、『Error during update of amavisd.conf』に辿り着いた。
其れ迄にも$hostnameや@mynetworkやら手を入れている。（入れないと動かない）

diffを取って差分から、変更箇所を記載する。

@bypass_virus_checks_maps = (1);  # controls running of anti-virus code
@bypass_spam_checks_maps  = (1);  # controls running of anti-spam code
$bypass_decode_parts = 1;         # controls running of decoders&dearchivers
$daemon_user  = '_amavisd';     # (no default;  customary: vscan or amavis), -u
$daemon_group  = '_amavisd';     # (no default;  customary: vscan or amavis), -g
$mydomain = 'k-in.co.jp';   # a convenient default for other settings
$MYHOME = '/opt/local/var/amavis';   # a convenient default for other settings, -H
$QUARANTINEDIR = '/opt/local/var/amavis/quarantine';  # -Q
$inet_socket_port = 10024;   # listen on this local TCP port(s)
$myhostname = 'mail.k-in.co.jp';
  ['ClamAV-clamd',
    \&ask_daemon, ["CONTSCAN {}\n", "/opt/local/var/run/clamav/clamd.socket"],
    qr/\bOK$/m, qr/\bFOUND$/m,
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],

@bypass_virus_checks_maps = (1); # controls running of anti-virus code

@bypass_spam_checks_maps = (1); # controls running of anti-spam code

$bypass_decode_parts = 1; # controls running of decoders&dearchivers

$daemon_user = '_amavisd'; # (no default; customary: vscan or amavis), -u

$daemon_group = '_amavisd'; # (no default; customary: vscan or amavis), -g

$mydomain = 'k-in.co.jp'; # a convenient default for other settings

$MYHOME = '/opt/local/var/amavis'; # a convenient default for other settings, -H

$QUARANTINEDIR = '/opt/local/var/amavis/quarantine'; # -Q

$inet_socket_port = 10024; # listen on this local TCP port(s)

$myhostname = 'mail.k-in.co.jp';

['ClamAV-clamd',

\&ask_daemon, ["CONTSCAN {}\n", "/opt/local/var/run/clamav/clamd.socket"],

qr/\bOK$/m, qr/\bFOUND$/m,

qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],

基本的にpathに/opt/localを追加。
それから、$mydomainと$myhostnameを設定。
受取用のport番号と、clamdを使用する設定をコメントアウト。
と云った処かな。

此れで漸くportが開いた。

一応nmapの結果。

Starting Nmap 7.95 ( https://nmap.org ) at 2024-11-29 15:50 JST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00093s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 500 closed tcp ports (conn-refused), 476 filtered tcp ports (no-response)
PORT      STATE SERVICE
22/tcp    open  ssh
24/tcp    open  priv-mail
25/tcp    open  smtp
53/tcp    open  domain
80/tcp    open  http
143/tcp   open  imap
443/tcp   open  https
445/tcp   open  microsoft-ds
465/tcp   open  smtps
548/tcp   open  afp
587/tcp   open  submission
631/tcp   open  ipp
783/tcp   open  spamassassin
873/tcp   open  rsync
993/tcp   open  imaps
995/tcp   open  pop3s
2525/tcp  open  ms-v-worlds
3283/tcp  open  netassistant
3306/tcp  open  mysql
3689/tcp  open  rendezvous
5900/tcp  open  vnc
10024/tcp open  unknown
10025/tcp open  unknown
12345/tcp open  netbus

Nmap done: 1 IP address (1 host up) scanned in 2.35 seconds

Starting Nmap 7.95 ( https://nmap.org ) at 2024-11-29 15:50 JST

Nmap scan report for localhost (127.0.0.1)

Host is up (0.00093s latency).

Other addresses for localhost (not scanned): ::1

Not shown: 500 closed tcp ports (conn-refused), 476 filtered tcp ports (no-response)

PORT STATE SERVICE

22/tcp open ssh

24/tcp open priv-mail

25/tcp open smtp

53/tcp open domain

80/tcp open http

143/tcp open imap

443/tcp open https

445/tcp open microsoft-ds

465/tcp open smtps

548/tcp open afp

587/tcp open submission

631/tcp open ipp

783/tcp open spamassassin

873/tcp open rsync

993/tcp open imaps

995/tcp open pop3s

2525/tcp open ms-v-worlds

3283/tcp open netassistant

3306/tcp open mysql

3689/tcp open rendezvous

5900/tcp open vnc

10024/tcp open unknown

10025/tcp open unknown

12345/tcp open netbus

Nmap done: 1 IP address (1 host up) scanned in 2.35 seconds

此のportに対するservice名を追加できないものかな。
と思ったら、既に遣って居た。
/etc/serviceに書き込むと対応して呉れる……筈なのに何故？

#
#### insert local port names ###
#
smtp-amavis     10024/tcp       # amavisd-new
postfix-filter  10025/tcp       # back to postfix from amavis

#### insert local port names ###

smtp-amavis 10024/tcp # amavisd-new

postfix-filter 10025/tcp # back to postfix from amavis

ちゃんと最後に此処に書けって書いてあるじゃん！なんで対応してくれないの？

opensslで接続してみた結果。

Connecting to 192.168.0.35
CONNECTED(00000005)
Didn't find STARTTLS in server response, trying anyway...
408B8B5DF87F0000:error:0A000126:SSL routines::unexpected eof while reading:ssl/record/rec_layer_s3.c:693:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 373 bytes
Verification: OK

Connecting to 192.168.0.35

CONNECTED(00000005)

Didn't find STARTTLS in server response, trying anyway...

408B8B5DF87F0000:error:0A000126:SSL routines::unexpected eof while reading:ssl/record/rec_layer_s3.c:693:

---

no peer certificate available

---

No client certificate CA names sent

---

SSL handshake has read 0 bytes and written 373 bytes

Verification: OK

応答を翻訳したら、
192.168.0.35 に接続中
接続済み (00000005)
サーバー応答に STARTTLS が見つかりませんでした。とにかく試してみます…
408B8B5DF87F0000:エラー:0A000126:SSL ルーチン::読み取り中に予期しない eof が発生しました:ssl/record/rec_layer_s3.c:693:
—
ピア証明書が利用できません
—
クライアント証明書の CA 名が送信されませんでした
—
SSL ハンドシェイクで 0 バイトが読み取られ、373 バイトが書き込まれました
検証: OK

との事で、postfixが証明書を読めて居ないようだ。（本当かな？）
Dovecotと共通で良いのだと思うんだけど、違うのか知らん。

現在の設定はこんな感じ。

alias_maps = hash:/etc/aliases
bounce_queue_lifetime = 1h
broken_sasl_auth_clients = yes
command_directory = /opt/local/sbin
compatibility_level = 3.9
content_filter = amavisfeed:localhost:10025
daemon_directory = /opt/local/libexec/postfix
data_directory = /opt/local/var/lib/postfix
debug_peer_level = 2
default_privs = nobody
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
local_recipient_maps = unix:passwd.byname $alias_maps
luser_relay = unknown_user@k-in.co.jp
mail_owner = _postfix
mail_spool_directory = /Volumes/Works/Library/mail/spool/
mailbox_size_limit = 0
mailbox_transport = lmtp:unix:private/dovecot-lmtp
maillog_file = /opt/local/var/log/postfix/postfix_log
maillog_file_permissions = 0644
maillog_file_prefixes = /opt/local/var/log, /opt/local/var/log/postfix
mailq_path = /opt/local/bin/mailq
manpage_directory = /opt/local/share/man
maximal_backoff_time = 300s
maximal_queue_lifetime = 1h
minimal_backoff_time = 400s
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, mail.$mydomain, smtp.$mydomain, imap.$mydomain
mydomain = k-in.co.jp
myhostname = mail.k-in.co.jp
mynetworks = 192.168.0.0/24, 127.0.0.0/8
mynetworks_style = class
myorigin = $mydomain
newaliases_path = /opt/local/bin/newaliases
postscreen_access_list = hash:/opt/local/etc/postfix/access_client, cidr:/opt/local/etc/postfix/access_cidr, cidr:/opt/local/etc/postfix/reject_cidr, hash:/opt/local/etc/postfix/reject_client
postscreen_blacklist_action = enforce
postscreen_cache_cleanup_interval = 12h
postscreen_cache_retention_time = 7h
postscreen_dnsbl_action = drop
postscreen_dnsbl_sites = zen.spamhaus.org, bl.spamcop.net, b.barracudacentral.org
postscreen_dnsbl_threshold = 2
postscreen_greet_action = enforce
queue_directory = /opt/local/var/spool/postfix
queue_run_delay = 300s
readme_directory = /opt/local/share/postfix/readme
receive_override_options = no_address_mappings
relay_domains =
relayhost =
sample_directory = /opt/local/share/postfix/sample
sendmail_path = /opt/local/sbin/sendmail
setgid_group = _postdrop
smtp_discard_ehlo_keywords = pipelining CRLF.CRLF
smtp_dns_support_level = dnssec
smtp_helo_name = $myhostname
smtp_host_lookup = dns, native
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname
smtpd_proxy_options = speed_adjust
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unverified_recipient reject_unauth_destination reject_non_fqdn_sender reject_non_fqdn_recipient reject_invalid_hostname reject_unknown_hostname reject_non_fqdn_helo_hostname
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext, noactive, nodictionary
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /opt/local/etc/ssl/certs/mail.k-in.co.jp.cert.pem
smtpd_tls_key_file = /opt/local/etc/ssl/private/mail.k-in.co.jp.key.pem
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:/opt/local/var/lib/postfix/smtpd_tls_session_cache
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550

alias_maps = hash:/etc/aliases

bounce_queue_lifetime = 1h

broken_sasl_auth_clients = yes

command_directory = /opt/local/sbin

compatibility_level = 3.9

content_filter = amavisfeed:localhost:10025

daemon_directory = /opt/local/libexec/postfix

data_directory = /opt/local/var/lib/postfix

debug_peer_level = 2

default_privs = nobody

html_directory = no

inet_interfaces = all

inet_protocols = ipv4

local_recipient_maps = unix:passwd.byname $alias_maps

luser_relay = unknown_user@k-in.co.jp

mail_owner = _postfix

mail_spool_directory = /Volumes/Works/Library/mail/spool/

mailbox_size_limit = 0

mailbox_transport = lmtp:unix:private/dovecot-lmtp

maillog_file = /opt/local/var/log/postfix/postfix_log

maillog_file_permissions = 0644

maillog_file_prefixes = /opt/local/var/log, /opt/local/var/log/postfix

mailq_path = /opt/local/bin/mailq

manpage_directory = /opt/local/share/man

maximal_backoff_time = 300s

maximal_queue_lifetime = 1h

minimal_backoff_time = 400s

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, mail.$mydomain, smtp.$mydomain, imap.$mydomain

mydomain = k-in.co.jp

myhostname = mail.k-in.co.jp

mynetworks = 192.168.0.0/24, 127.0.0.0/8

mynetworks_style = class

myorigin = $mydomain

newaliases_path = /opt/local/bin/newaliases

postscreen_access_list = hash:/opt/local/etc/postfix/access_client, cidr:/opt/local/etc/postfix/access_cidr, cidr:/opt/local/etc/postfix/reject_cidr, hash:/opt/local/etc/postfix/reject_client

postscreen_blacklist_action = enforce

postscreen_cache_cleanup_interval = 12h

postscreen_cache_retention_time = 7h

postscreen_dnsbl_action = drop

postscreen_dnsbl_sites = zen.spamhaus.org, bl.spamcop.net, b.barracudacentral.org

postscreen_dnsbl_threshold = 2

postscreen_greet_action = enforce

queue_directory = /opt/local/var/spool/postfix

queue_run_delay = 300s

readme_directory = /opt/local/share/postfix/readme

receive_override_options = no_address_mappings

relay_domains =

relayhost =

sample_directory = /opt/local/share/postfix/sample

sendmail_path = /opt/local/sbin/sendmail

setgid_group = _postdrop

smtp_discard_ehlo_keywords = pipelining CRLF.CRLF

smtp_dns_support_level = dnssec

smtp_helo_name = $myhostname

smtp_host_lookup = dns, native

smtp_tls_loglevel = 1

smtp_tls_security_level = may

smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname

smtpd_proxy_options = speed_adjust

smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unverified_recipient reject_unauth_destination reject_non_fqdn_sender reject_non_fqdn_recipient reject_invalid_hostname reject_unknown_hostname reject_non_fqdn_helo_hostname

smtpd_sasl_auth_enable = yes

smtpd_sasl_local_domain = $mydomain

smtpd_sasl_path = private/auth

smtpd_sasl_security_options = noanonymous, noplaintext, noactive, nodictionary

smtpd_sasl_tls_security_options = noanonymous

smtpd_sasl_type = dovecot

smtpd_sender_restrictions = reject_unknown_sender_domain

smtpd_tls_auth_only = no

smtpd_tls_cert_file = /opt/local/etc/ssl/certs/mail.k-in.co.jp.cert.pem

smtpd_tls_key_file = /opt/local/etc/ssl/private/mail.k-in.co.jp.key.pem

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

smtpd_tls_received_header = yes

smtpd_tls_session_cache_database = btree:/opt/local/var/lib/postfix/smtpd_tls_session_cache

tls_random_source = dev:/dev/urandom

unknown_local_recipient_reject_code = 550

変更箇所が思ったよりも多い。
此の中から間違い探しするのは大変だぁ〜〜。(^_^;;

opensslコマンドで、証明書ファイルのチェックができることを知った。
OpenSSLコマンドで証明書のチェックと、其の儘のタイトルが有ったのだ。
ウチの場合だと、下記の様になる。

% sudo openssl s_server -cert certs/mail.k-in.co.jp.cert.pem -key private/mail.k-in.co.jp.key.pem  -CAfile certs/mail.k-in.co.jp.chain.pem
Using default temp DH parameters
ACCEPT

% sudo openssl s_server -cert certs/mail.k-in.co.jp.cert.pem -key private/mail.k-in.co.jp.key.pem -CAfile certs/mail.k-in.co.jp.chain.pem

Using default temp DH parameters

最初間違えて、password解除前の鍵ファイルを指定して、パスワード入力を要求された。
なので、postfix/main.cfでも間違えたのかと思えば、そうでも無いようだ。
opensslでwww.k-in.co.jp:443に接続するとこうなる。

% openssl s_client -connect www.k-in.co.jp:443
Connecting to 192.168.0.35
CONNECTED(00000005)
depth=0 CN=www.k-in.co.jp
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN=www.k-in.co.jp
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN=www.k-in.co.jp
verify return:1
---
Certificate chain
 0 s:CN=www.k-in.co.jp
   i:C=JP, ST=Tokyo, L=Shibuya-ku, O=Nijimo K.K., CN=FujiSSL SHA2 Domain Secure Site CA
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Nov 11 00:00:00 2024 GMT; NotAfter: Dec 12 23:59:59 2025 GMT
 1 s:C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
   i:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA384
   v:NotBefore: Nov  2 00:00:00 2018 GMT; NotAfter: Dec 31 23:59:59 2030 GMT
 2 s:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
   i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA384
   v:NotBefore: Mar 12 00:00:00 2019 GMT; NotAfter: Dec 31 23:59:59 2028 GMT
 3 s:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
   i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1
   v:NotBefore: Jan  1 00:00:00 2004 GMT; NotAfter: Dec 31 23:59:59 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGGDCCBQCgAwIBAgIQTLcNvRy5yRx9VfhCj0E2WjANBgkqhkiG9w0BAQsFADB1
MQswCQYDVQQGEwJKUDEOMAwGA1UECBMFVG9reW8xEzARBgNVBAcTClNoaWJ1eWEt
a3UxFDASBgNVBAoTC05pamltbyBLLksuMSswKQYDVQQDEyJGdWppU1NMIFNIQTIg
RG9tYWluIFNlY3VyZSBTaXRlIENBMB4XDTI0MTExMTAwMDAwMFoXDTI1MTIxMjIz
NTk1OVowGTEXMBUGA1UEAxMOd3d3LmstaW4uY28uanAwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQC6rWS4/wQrvkyFDCyNZK3rOO83aefHo+sMkErpFQDv
D5FVcZuAdjGLDpw32jR6Q3YbC6wR/anebfHm6foGo8JZ3mfN/d+O3+Rhs+FxUse1
ScJiS41AW7zXXjReJAi5OvsO9DMaC+APDQE4O3YREKUJfPEFeuDd+a5w4qSGuLIH
MVauXSHMZ93jJiQSVfl/gBCfRZO7gfkoOjtYe1ut6vLedJPka0HtFoXxuMXBjbQG
aQOv3lykOOrHVjvBvX1nvQeEn+7cj3Gi5jpcdp1qvRit+0lPxqBeQxymOAVQHIY/
Qpj90SCkKt4LQexPfVPw4mwfpERAZ+ZC6zbvzX/pLRavAgMBAAGjggL+MIIC+jAf
BgNVHSMEGDAWgBTmIkBPpFCpei2TOVGvsp1zNvPBsDAdBgNVHQ4EFgQUFnDnozL8
GdGCc9DCn1YyGAk6IuIwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYD
VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGy
MQECAkUwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYG
Z4EMAQIBMIGHBggrBgEFBQcBAQR7MHkwSwYIKwYBBQUHMAKGP2h0dHA6Ly9uaWpp
bW8uY3J0LnNlY3RpZ28uY29tL0Z1amlTU0xTSEEyRG9tYWluU2VjdXJlU2l0ZUNB
LmNydDAqBggrBgEFBQcwAYYeaHR0cDovL25pamltby5vY3NwLnNlY3RpZ28uY29t
MCUGA1UdEQQeMByCDnd3dy5rLWluLmNvLmpwggprLWluLmNvLmpwMIIBfQYKKwYB
BAHWeQIEAgSCAW0EggFpAWcAdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sAOhQSdgos
rLvIKgAAAZMZ4/fRAAAEAwBHMEUCIQDq3AYZpvHGtr99a9Np/xDpkNm2pX2DEcYj
KgqpgyHG5AIgfnP7Sgbrykw8t2U+9mzMED1KM2mjtd1PIzpRjnllKJ0AdQDM+w9q
hXEJZf6Vm1PO6bJ8IumFXA2XjbapflTA/kwNsAAAAZMZ4/eeAAAEAwBGMEQCIEWT
fUalCZUXqhh4v6hpLctmHYKmCBkjrYP5bweofc4hAiAvVKq+OVmodboOReomfE13
N4MxX2tpxjgRZ74uaKYMiwB2ABLxTjS9U3JMhAYZw48/ehP457Vih4icbTAFhOvl
hiY6AAABkxnj93AAAAQDAEcwRQIhANdvVzXJhfq+U0jBixgHJASBKcfMJUeoM+JN
vt23SNgEAiAEly/Cdt06QJHrq9c+y7yu8YF6PLfl9HEhBek5RBJogzANBgkqhkiG
9w0BAQsFAAOCAQEAqM0Z7MwB9pc9QhEwI097Lg55LMU975LuXNMxH4XadYbo4SnU
Dse3htQHXdyrI2NnkEk/HkEoY817Csl5lWGjk/jpS1NPw7P3GJWA4RhCfKcdCz6d
tAB2QFD+/7kvWvznsK4O/vceMp/H7To9CbPe4RmbJEes5ABDhQt1/UT0kdf9VuuR
NiqN2vQ7SQ/wGs1AYlQvUsZkqlDFaKvM9fDQAWSBR1ANUL6Jnnlv8GkMckS9/507
TQbfWKbbMxBhp/HZgp3s2cgKP/4mqqg7BmWM2BpyIEnjP5WPCNuRge0kYe+WYJ66
4/x15HFO6AfxfEU0ZFm2Hue/NvXqg8cnoHe6qA==
-----END CERTIFICATE-----
subject=CN=www.k-in.co.jp
issuer=C=JP, ST=Tokyo, L=Shibuya-ku, O=Nijimo K.K., CN=FujiSSL SHA2 Domain Secure Site CA
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 6189 bytes and written 412 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: A1F0A1115487C1385FDAA3913CF3EEB4268C1811CB9928C0AC8520501ECCA9C3
    Session-ID-ctx: 
    Resumption PSK: 5975CF79E9442E48BEABBD96F32DBFEFF8B7130CB305CC0298706845E1E6EBB78D566E4D42441BF1AB112D03EF940933
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - a9 59 c8 5b 11 eb 2f 39-2a cd 01 36 69 0d cd 47   .Y.[../9*..6i..G
    0010 - 76 50 e0 fe 66 4f 23 b0-78 89 ef 97 90 af 57 e8   vP..fO#.x.....W.
    0020 - 33 82 b9 42 eb 9d ab c2-b8 f7 8a c2 53 6b d6 4c   3..B........Sk.L
    0030 - 2f 06 6a 87 a2 47 39 53-59 9d 5c 22 da e5 41 92   /.j..G9SY.\"..A.
    0040 - 69 ae 2b af e4 25 2c ee-6b 19 46 91 02 31 8d 89   i.+..%,.k.F..1..
    0050 - f2 c6 bb 5c 81 64 df 96-86 90 0d ea b6 4d fc b1   ...\.d.......M..
    0060 - cf 2f 4b 59 ba 9a 85 f2-24 a2 9b c2 74 f7 53 dd   ./KY....$...t.S.
    0070 - 58 c6 3d 0d 50 74 03 4f-65 c8 8e 99 5a 84 32 34   X.=.Pt.Oe...Z.24
    0080 - a9 41 10 a6 ab 15 93 e4-63 4b 64 b4 cd 16 96 7b   .A......cKd....{
    0090 - d0 47 c1 2d 85 66 d1 80-e2 14 58 d4 f5 81 a6 16   .G.-.f....X.....
    00a0 - 29 6e 35 f8 7f 05 3d ad-3a a1 fa 98 ce 69 b2 10   )n5...=.:....i..
    00b0 - 38 a8 e1 ee 73 f6 09 ed-b2 83 5d 5b c3 a8 f9 a6   8...s.....][....
    00c0 - f4 b7 7a 27 62 a3 6c 4a-c1 5a f5 20 52 34 9a a8   ..z'b.lJ.Z. R4..
    00d0 - 5f 96 c5 04 f8 e1 9b f0-60 46 a9 31 74 26 e5 b4   _.......`F.1t&..
    00e0 - e6 72 df 16 20 20 4c 0a-36 9e b2 cd 92 74 40 80   .r..  L.6....t@.
    00f0 - 8f 99 30 ea 58 73 fb f4-25 e4 74 b5 2c 93 85 b9   ..0.Xs..%.t.,...

    Start Time: 1733124957
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 6741A4BF69032F32DD50B6F2E02B91970A4C8848656F8DDB8FD95E0B76CBC309
    Session-ID-ctx: 
    Resumption PSK: F500FDEC129BE5149AA9E6B4A3311A54826EA335E2CF37471EE9915548AAB2370506E08AC13CBB122CE22019BEF6FA6F
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - a9 59 c8 5b 11 eb 2f 39-2a cd 01 36 69 0d cd 47   .Y.[../9*..6i..G
    0010 - 03 4b d6 40 8f 17 f2 24-4f a6 62 fd 34 0c 3e 78   .K.@...$O.b.4.>x
    0020 - fa c5 17 60 5d ef a8 ff-43 bd 57 a4 85 4c a9 e9   ...`]...C.W..L..
    0030 - fe c6 93 e3 00 27 09 6a-08 d4 7b 60 d6 65 52 07   .....'.j..{`.eR.
    0040 - e8 ea 04 cd 3c 41 fd f8-61 ec b9 fd 35 55 4c ec   ....<A..a...5UL.
    0050 - 0b 3d 6d c8 57 d6 48 55-b3 5c 85 ae c7 7d 79 b8   .=m.W.HU.\...}y.
    0060 - 90 f2 dc a7 4f 8c 7c 67-f9 cc ea 72 9e 67 90 e3   ....O.|g...r.g..
    0070 - 65 be 4b b0 b6 4e 94 ca-c3 37 74 10 aa 9d 9b 1d   e.K..N...7t.....
    0080 - cd 6f 0e 5b 38 3c 16 91-6c af a1 a4 58 50 c4 ee   .o.[8<..l...XP..
    0090 - f3 73 7b 3b a7 5d ac cf-1b df 76 c0 b0 e9 da a3   .s{;.]....v.....
    00a0 - 52 79 8c fc 9f 00 66 e7-0d 95 0c a9 c9 6a 31 c3   Ry....f......j1.
    00b0 - 7c 59 67 e0 44 b9 ae 66-0f e6 b2 31 b6 29 9a a7   |Yg.D..f...1.)..
    00c0 - 7d e3 c2 95 92 7d e9 02-44 63 3d ee d9 06 9f f9   }....}..Dc=.....
    00d0 - 1c e9 11 a1 97 b8 86 d2-37 fb 1e 11 b0 a3 28 df   ........7.....(.
    00e0 - 74 e7 f9 c3 7f 8e e4 c7-64 14 e3 09 86 c2 bd d9   t.......d.......
    00f0 - ae 89 06 9f af 7e a7 79-5b cf 71 75 93 0b d2 ba   .....~.y[.qu....

    Start Time: 1733124957
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

% openssl s_client -connect www.k-in.co.jp:443

Connecting to 192.168.0.35

CONNECTED(00000005)

depth=0 CN=www.k-in.co.jp

verify error:num=20:unable to get local issuer certificate

verify return:1

depth=0 CN=www.k-in.co.jp

verify error:num=21:unable to verify the first certificate

verify return:1

depth=0 CN=www.k-in.co.jp

verify return:1

---

Certificate chain

0 s:CN=www.k-in.co.jp

i:C=JP, ST=Tokyo, L=Shibuya-ku, O=Nijimo K.K., CN=FujiSSL SHA2 Domain Secure Site CA

a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

v:NotBefore: Nov 11 00:00:00 2024 GMT; NotAfter: Dec 12 23:59:59 2025 GMT

1 s:C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA

i:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority

a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA384

v:NotBefore: Nov 2 00:00:00 2018 GMT; NotAfter: Dec 31 23:59:59 2030 GMT

2 s:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority

i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services

a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA384

v:NotBefore: Mar 12 00:00:00 2019 GMT; NotAfter: Dec 31 23:59:59 2028 GMT

3 s:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services

i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services

a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1

v:NotBefore: Jan 1 00:00:00 2004 GMT; NotAfter: Dec 31 23:59:59 2028 GMT

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIGGDCCBQCgAwIBAgIQTLcNvRy5yRx9VfhCj0E2WjANBgkqhkiG9w0BAQsFADB1

MQswCQYDVQQGEwJKUDEOMAwGA1UECBMFVG9reW8xEzARBgNVBAcTClNoaWJ1eWEt

a3UxFDASBgNVBAoTC05pamltbyBLLksuMSswKQYDVQQDEyJGdWppU1NMIFNIQTIg

RG9tYWluIFNlY3VyZSBTaXRlIENBMB4XDTI0MTExMTAwMDAwMFoXDTI1MTIxMjIz

NTk1OVowGTEXMBUGA1UEAxMOd3d3LmstaW4uY28uanAwggEiMA0GCSqGSIb3DQEB

AQUAA4IBDwAwggEKAoIBAQC6rWS4/wQrvkyFDCyNZK3rOO83aefHo+sMkErpFQDv

D5FVcZuAdjGLDpw32jR6Q3YbC6wR/anebfHm6foGo8JZ3mfN/d+O3+Rhs+FxUse1

ScJiS41AW7zXXjReJAi5OvsO9DMaC+APDQE4O3YREKUJfPEFeuDd+a5w4qSGuLIH

MVauXSHMZ93jJiQSVfl/gBCfRZO7gfkoOjtYe1ut6vLedJPka0HtFoXxuMXBjbQG

aQOv3lykOOrHVjvBvX1nvQeEn+7cj3Gi5jpcdp1qvRit+0lPxqBeQxymOAVQHIY/

Qpj90SCkKt4LQexPfVPw4mwfpERAZ+ZC6zbvzX/pLRavAgMBAAGjggL+MIIC+jAf

BgNVHSMEGDAWgBTmIkBPpFCpei2TOVGvsp1zNvPBsDAdBgNVHQ4EFgQUFnDnozL8

GdGCc9DCn1YyGAk6IuIwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYD

VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGy

MQECAkUwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYG

Z4EMAQIBMIGHBggrBgEFBQcBAQR7MHkwSwYIKwYBBQUHMAKGP2h0dHA6Ly9uaWpp

bW8uY3J0LnNlY3RpZ28uY29tL0Z1amlTU0xTSEEyRG9tYWluU2VjdXJlU2l0ZUNB

LmNydDAqBggrBgEFBQcwAYYeaHR0cDovL25pamltby5vY3NwLnNlY3RpZ28uY29t

MCUGA1UdEQQeMByCDnd3dy5rLWluLmNvLmpwggprLWluLmNvLmpwMIIBfQYKKwYB

BAHWeQIEAgSCAW0EggFpAWcAdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sAOhQSdgos

rLvIKgAAAZMZ4/fRAAAEAwBHMEUCIQDq3AYZpvHGtr99a9Np/xDpkNm2pX2DEcYj

KgqpgyHG5AIgfnP7Sgbrykw8t2U+9mzMED1KM2mjtd1PIzpRjnllKJ0AdQDM+w9q

hXEJZf6Vm1PO6bJ8IumFXA2XjbapflTA/kwNsAAAAZMZ4/eeAAAEAwBGMEQCIEWT

fUalCZUXqhh4v6hpLctmHYKmCBkjrYP5bweofc4hAiAvVKq+OVmodboOReomfE13

N4MxX2tpxjgRZ74uaKYMiwB2ABLxTjS9U3JMhAYZw48/ehP457Vih4icbTAFhOvl

hiY6AAABkxnj93AAAAQDAEcwRQIhANdvVzXJhfq+U0jBixgHJASBKcfMJUeoM+JN

vt23SNgEAiAEly/Cdt06QJHrq9c+y7yu8YF6PLfl9HEhBek5RBJogzANBgkqhkiG

9w0BAQsFAAOCAQEAqM0Z7MwB9pc9QhEwI097Lg55LMU975LuXNMxH4XadYbo4SnU

Dse3htQHXdyrI2NnkEk/HkEoY817Csl5lWGjk/jpS1NPw7P3GJWA4RhCfKcdCz6d

tAB2QFD+/7kvWvznsK4O/vceMp/H7To9CbPe4RmbJEes5ABDhQt1/UT0kdf9VuuR

NiqN2vQ7SQ/wGs1AYlQvUsZkqlDFaKvM9fDQAWSBR1ANUL6Jnnlv8GkMckS9/507

TQbfWKbbMxBhp/HZgp3s2cgKP/4mqqg7BmWM2BpyIEnjP5WPCNuRge0kYe+WYJ66

4/x15HFO6AfxfEU0ZFm2Hue/NvXqg8cnoHe6qA==

-----END CERTIFICATE-----

subject=CN=www.k-in.co.jp

issuer=C=JP, ST=Tokyo, L=Shibuya-ku, O=Nijimo K.K., CN=FujiSSL SHA2 Domain Secure Site CA

---

No client certificate CA names sent

Peer signing digest: SHA256

Peer signature type: RSA-PSS

Server Temp Key: X25519, 253 bits

---

SSL handshake has read 6189 bytes and written 412 bytes

Verification error: unable to verify the first certificate

---

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384

Protocol: TLSv1.3

Server public key is 2048 bit

This TLS version forbids renegotiation.

Compression: NONE

Expansion: NONE

No ALPN negotiated

Early data was not sent

Verify return code: 21 (unable to verify the first certificate)

---

Post-Handshake New Session Ticket arrived:

SSL-Session:

Protocol : TLSv1.3

Cipher : TLS_AES_256_GCM_SHA384

Session-ID: A1F0A1115487C1385FDAA3913CF3EEB4268C1811CB9928C0AC8520501ECCA9C3

Session-ID-ctx:

Resumption PSK: 5975CF79E9442E48BEABBD96F32DBFEFF8B7130CB305CC0298706845E1E6EBB78D566E4D42441BF1AB112D03EF940933

PSK identity: None

PSK identity hint: None

SRP username: None

TLS session ticket lifetime hint: 300 (seconds)

TLS session ticket:

0000 - a9 59 c8 5b 11 eb 2f 39-2a cd 01 36 69 0d cd 47 .Y.[../9*..6i..G

0010 - 76 50 e0 fe 66 4f 23 b0-78 89 ef 97 90 af 57 e8 vP..fO#.x.....W.

0020 - 33 82 b9 42 eb 9d ab c2-b8 f7 8a c2 53 6b d6 4c 3..B........Sk.L

0030 - 2f 06 6a 87 a2 47 39 53-59 9d 5c 22 da e5 41 92 /.j..G9SY.\"..A.

0040 - 69 ae 2b af e4 25 2c ee-6b 19 46 91 02 31 8d 89 i.+..%,.k.F..1..

0050 - f2 c6 bb 5c 81 64 df 96-86 90 0d ea b6 4d fc b1 ...\.d.......M..

0060 - cf 2f 4b 59 ba 9a 85 f2-24 a2 9b c2 74 f7 53 dd ./KY....$...t.S.

0070 - 58 c6 3d 0d 50 74 03 4f-65 c8 8e 99 5a 84 32 34 X.=.Pt.Oe...Z.24

0080 - a9 41 10 a6 ab 15 93 e4-63 4b 64 b4 cd 16 96 7b .A......cKd....{

0090 - d0 47 c1 2d 85 66 d1 80-e2 14 58 d4 f5 81 a6 16 .G.-.f....X.....

00a0 - 29 6e 35 f8 7f 05 3d ad-3a a1 fa 98 ce 69 b2 10 )n5...=.:....i..

00b0 - 38 a8 e1 ee 73 f6 09 ed-b2 83 5d 5b c3 a8 f9 a6 8...s.....][....

00c0 - f4 b7 7a 27 62 a3 6c 4a-c1 5a f5 20 52 34 9a a8 ..z'b.lJ.Z. R4..

00d0 - 5f 96 c5 04 f8 e1 9b f0-60 46 a9 31 74 26 e5 b4 _.......`F.1t&..

00e0 - e6 72 df 16 20 20 4c 0a-36 9e b2 cd 92 74 40 80 .r.. L.6....t@.

00f0 - 8f 99 30 ea 58 73 fb f4-25 e4 74 b5 2c 93 85 b9 ..0.Xs..%.t.,...

Start Time: 1733124957

Timeout : 7200 (sec)

Verify return code: 21 (unable to verify the first certificate)

Extended master secret: no

Max Early Data: 0

---

read R BLOCK

---

Post-Handshake New Session Ticket arrived:

SSL-Session:

Protocol : TLSv1.3

Cipher : TLS_AES_256_GCM_SHA384

Session-ID: 6741A4BF69032F32DD50B6F2E02B91970A4C8848656F8DDB8FD95E0B76CBC309

Session-ID-ctx:

Resumption PSK: F500FDEC129BE5149AA9E6B4A3311A54826EA335E2CF37471EE9915548AAB2370506E08AC13CBB122CE22019BEF6FA6F

PSK identity: None

PSK identity hint: None

SRP username: None

TLS session ticket lifetime hint: 300 (seconds)

TLS session ticket:

0000 - a9 59 c8 5b 11 eb 2f 39-2a cd 01 36 69 0d cd 47 .Y.[../9*..6i..G

0010 - 03 4b d6 40 8f 17 f2 24-4f a6 62 fd 34 0c 3e 78 .K.@...$O.b.4.>x

0020 - fa c5 17 60 5d ef a8 ff-43 bd 57 a4 85 4c a9 e9 ...`]...C.W..L..

0030 - fe c6 93 e3 00 27 09 6a-08 d4 7b 60 d6 65 52 07 .....'.j..{`.eR.

0040 - e8 ea 04 cd 3c 41 fd f8-61 ec b9 fd 35 55 4c ec ....<A..a...5UL.

0050 - 0b 3d 6d c8 57 d6 48 55-b3 5c 85 ae c7 7d 79 b8 .=m.W.HU.\...}y.

0060 - 90 f2 dc a7 4f 8c 7c 67-f9 cc ea 72 9e 67 90 e3 ....O.|g...r.g..

0070 - 65 be 4b b0 b6 4e 94 ca-c3 37 74 10 aa 9d 9b 1d e.K..N...7t.....

0080 - cd 6f 0e 5b 38 3c 16 91-6c af a1 a4 58 50 c4 ee .o.[8<..l...XP..

0090 - f3 73 7b 3b a7 5d ac cf-1b df 76 c0 b0 e9 da a3 .s{;.]....v.....

00a0 - 52 79 8c fc 9f 00 66 e7-0d 95 0c a9 c9 6a 31 c3 Ry....f......j1.

00b0 - 7c 59 67 e0 44 b9 ae 66-0f e6 b2 31 b6 29 9a a7 |Yg.D..f...1.)..

00c0 - 7d e3 c2 95 92 7d e9 02-44 63 3d ee d9 06 9f f9 }....}..Dc=.....

00d0 - 1c e9 11 a1 97 b8 86 d2-37 fb 1e 11 b0 a3 28 df ........7.....(.

00e0 - 74 e7 f9 c3 7f 8e e4 c7-64 14 e3 09 86 c2 bd d9 t.......d.......

00f0 - ae 89 06 9f af 7e a7 79-5b cf 71 75 93 0b d2 ba .....~.y[.qu....

Start Time: 1733124957

Timeout : 7200 (sec)

Verify return code: 21 (unable to verify the first certificate)

Extended master secret: no

Max Early Data: 0

---

read R BLOCK

Verify return code: 21 (unable to verify the first certificate)が出ているんだよねぇ。
でもルート証明書まで出てきている。
何が正しいのか判らん。
只、web browserでエラーが出て居なければ良いのか？

mail serverの移行（その43）Postfix、Dovecotの再構築

関連

コメントを残すコメントをキャンセル

2024年12月
日	月	火	水	木	金	土
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30	31