ssl证书生成

openssl req -new -x509 -days 3650 -nodes -out /opt/ssl/certs/postfix.pem -keyout /opt/ssl/private/postfix.pem

第一个是证书，第二个是key(私钥)
可以应用在很多程序上。
下面举两个例子:

1. nginx
2. postfix

nginx ssl

server {    listen       443;    server_name  _;    ssl                  on;    ssl_certificate      /opt/ssl/certs/postfix.pem;    ssl_certificate_key  /opt/ssl/private/postfix.pem;    ssl_session_timeout  5m;    ssl_protocols  SSLv2 SSLv3 TLSv1;    ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;    ssl_prefer_server_ciphers   on;    location / {        root   html;        index  index.html index.htm;    }}

nginx -t 测试无误即可。当然这个证书自己做的浏览器会报一个不受信任的警告。

postfix ssl

vim /etc/postfix/main.cf

smtpd_tls_security_level = may#smtpd_tls_security_level = encryptsmtpd_tls_key_file = /opt/ssl/private/postfix.pemsmtpd_tls_cert_file = /opt/ssl/certs/postfix.pemsmtpd_tls_loglevel = 1smtpd_tls_session_cache_timeout = 3600ssmtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cachetls_random_source = dev:/dev/urandomsmtpd_tls_auth_only = yes

发邮件，看maillog的日志是是否有tls的类似记录即表示ssl。

postfix/smtpd[29635]: setting up TLS connection from unknown[114。。]

另外，可以telnet localhost 25

ehlo localhost250-mail.gqdw.xyz250-PIPELINING250-SIZE 10240000250-VRFY250-ETRN250-STARTTLS250-ENHANCEDSTATUSCODES250-8BITMIME250 DSN

starttls 表示已经开启ssl会话加密 。