CACert.org and OpenSSL howto for Apache, Courier IMAPS, etc. Forget self signed certs, with CACert.org, you can get a “free” SSL certificate. That will stop those annoying warnings in your browser about self signed certs.

Change into a directory where SSL certs are to be made.. (for this example I’ll be making my Courier IMAPS work nice!).. Oh ya, for this to work, I’m going to be root..

cd /etc/courier/

Now generate a key. (It goes without saying that where ever I use mail.myserver.com should be your full hostname or FQDM).

openssl genrsa -out mail.myserver.com.key 4096

Create a config file for OpenSSL to use. (You don’t have to do this but it saves typing a lot of the same information in.)

vi imapd.cnf

Paste this text in to the imapd.cnf file (changing what makes sense to change!)

RANDFILE = /usr/lib/courier/imapd.rand

[ req ]
default_bits = 4096
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no

[ req_dn ]
C=<Country Code>		# eg: IE
ST=<County>			# eg: Co Dublin
L=<Town>			# eg: Sandyford
O=<Company name>		# eg: Widgets Ltd
OU=<Department>			# eg: IT Department
CN=<hostname>			# eg: mail.me.com
emailAddress=<address>		# eg: postmaster@mail.me.com

[ cert_type ]
nsCertType = server

Now generate your CSR (Certificate Signing Request) file.

openssl req -new -nodes -key mail.myserver.com.key -config imapd.cnf -out mail.myserver.com.csr

Have a peek at the CSR (Certificate Signing Request) file.. you’ll need to copy this to CACert.org’s application form text box.

It should look something like this…

-----BEGIN CERTIFICATE REQUEST-----
MIIE7TCCAtUCAQAwgacxCzAJBgNVBAYTAklFMRIwEAYDVQQIEwlDbyBEdWJsaW4x
EjAQBgNVBAcTCVNhbmR5Zm9yZDETMBEGA1UEChMKRmludGVsIEx0ZDEWMBQGA1UE
CxMNSVQgRGVwYXJ0bWVudDEYMBYGA1UEAxMPbWFpbC5maW5kdWIuY29tMSkwJwYJ
.
.
.
sJfK4uH1XJpffJimUApbMdwDyIHwAe6nR1k6BNtN1FJMlzUGNGSGt0oEZ2oH2rtA
6+SyNlTwsD0htcJhYhkv8Xw=
-----END CERTIFICATE REQUEST-----

Sign up with CACert.org

https://www.cacert.org/index.php?id=1

Once you’ve got an account, you will have to register an email address..

https://www.cacert.org/account.php?id=1

Then goto: Server Certificates -> New

https://www.cacert.org/account.php?id=10

Paste your CSR text into the textbox on this page..

The good folk at CACert.org will email you a link that you have to follow in order to issue a CRT file.. Then you have got the CRT file contents in your clipboard, paste them in to a file.

vi mail.myserver.com.crt

Save this file in the same directory the KEY and CSR file are..

Now we need to create a PEM file. This is simply the KEY and CRT file back to back with some Diffie-Hellman stuff at the end.

cat mail.myserver.com.key mail.myserver.com.crt > mail.myserver.com.pem

This generates Diffie-Hellman parameters, and appends them to the pem file.

openssl gendh >> mail.myserver.com.pem

Now make the lot safe.

chmod 400 mail.myserver.com.*

That is it.. now you have CACert signed SSL solution for use with either Apache, Courier IMAP, Postfix, etc.. any application that requires a CRT/PEM/KEY/CSR file combination to work.

Installing Apple’s Darwin Calendar Server is fairly trivial… Here are the step in one document.

Install procedure for Ubuntu

Installing Apple’s Darwin Calendar Server is fairly trivial… Here are the step in one document.

Ready?

Log into the server console or via ssh, so you can enter commands(!) and run to get root access:

su -l

Install some software:

apt-get install subversion libkrb5-dev attr curl build-essential libssl-dev python-pysqlite2 bzip2 zope3 python-xml python-pyopenssl python-dateutil python-xattr python-pysqlite2 python-twisted python-vobject python-kerberos python-dev

We now need to edit our /etc/fstab file and add user_xattr to the options for the partition containing the CalDAV server, / in this case:

vi /etc/fstab

This is what the /etc/fstab change looks like:

Before: UUID=1234567-1234-4321-9876-12345678 / ext3 defaults,errors=remount-ro 0 1

After : UUID=1234567-1234-4321-9876-12345678 / ext3 defaults,errors=remount-ro,user_xattr 0 1

Remount the file system (to activate user_xattr):

mount -o remount /

Create a directory for our server to live in:

mkdir /opt/caldavd

cd /opt/caldavd

Let’s download the server software itself using subversion:

svn checkout http://svn.macosforge.org/repository/calendarserver/CalendarServer/tags/release/CalendarServer-1.2 CalendarServer

Subversion has downloaded a lot of software, and created a directory for us, called CalendarServer. Let’s change into it:

cd CalendarServer

Run a script to download some necessary packages, configure, etc:

./run -s

Almost ready for action…. Let’s copy the configuration:

cp conf/caldavd-test.plist conf/caldavd-dev.plist

We do need to do a little configuration though:

vi conf/caldavd-dev.plist

First change the hostname for the server. Locate the line:

 <!-- Network host name --> 

and change  <string>localhost</string>  to  <string>your-real-hostname</string> 

To make the server available to connections from other computers. Locate this line:

<!-- List of IP addresses to bind to [empty = all] --> and replace  127.0.0.1  in  <string>127.0.0.1</string>  with either nothing or a specific, public ip address for your server.

Create a user and group to give our server an identity of its own, but we don’t need a home directory for it:

adduser –system –group caldavd –no-create-home

Set permissions:

chown -R caldavd:caldavd /opt/caldavd

Run the server:

sudo -u caldavd -b /opt/caldavd/CalendarServer/run

That’s it! The server is up and running, and you can connect to it with your CalDAV client using  caldav://ADDRESS:8008/calendars/users/admin/calendar to test the server using username  admin  and password  admin 

To work with Apple iCal under Mac OS 10.5, the URI required was simply:  caldav://ADDRESS:8008 

Here is an example init script: /etc/init.d/caldavd

#! /bin/sh

. /lib/lsb/init-functions

CALDAVD="/opt/caldavd/CalendarServer/run"
CALDAVD_USER="caldavd"
CALDAVD_OPTS="-d"
PIDFILE="/opt/caldavd/CalendarServer/logs/caldavd.pid"
NAME=caldavd

test -x $CALDAVD || exit 0

case "$1" in
  start)
        log_daemon_msg "Starting Darwin Calendar Server" "$NAME"
        if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --chuid $CALDAVD_USER --exec $CALDAVD -- $CALDAVD_OPTS; then
            log_end_msg 0
        else
            log_end_msg 1
        fi
        ;;
  stop)
        log_daemon_msg "Stopping Darwin Calendar Server" "$NAME"
        if start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE; then
            log_end_msg 0
        else
            log_end_msg 1
        fi
        ;;
  restart)
        log_daemon_msg "Restarting Darwin Calendar Server" "$NAME"
        start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile $PIDFILE
        if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --chuid $CALDAVD_USER --exec $CALDAVD -- $CALDAVD_OPTS; then
            log_end_msg 0
        else
            log_end_msg 1
        fi
        ;;
  status)
        status_of_proc -p "$CALDAVD" "$NAME" && exit 0 || exit $?
        ;;
  *)
        log_action_msg "Usage: /etc/init.d/caldavd {start|stop|restart|status}"
        exit 1
esac

exit 0

And to get it to load on boot and shutdown safely:

update-rc.d caldavd defaults

Done..!

Have a look in the /opt/caldavd/CalendarServer/conf directory, there you will find all the config files for users, calendars, etc.

The information on this page is a little “re-work” of the wiki.ubuntu.com/CalendarServer page.