Joe Mocker's Weblog: How'd you know I was blogging at you if you weren't blogging at me?

I've been running IMAP over SSL for a while on Solaris, but until recently I've used STunnel to provide the SSL support in front of a plain IMAP daemon. I've known that you could compile SSL into imap for a while but never really looked into it until Rama figured out the magic certificate generation piece.

But what Rama did was to just install the Sunfreeware version of imapd. I have a love/hate relationship with those types of distributions, so I decided to look at compiling it myself. Heck Solaris includes OpenSSL so it should be easy.

Well, actually, I couldn't get it to build with the version of OpenSSL that ships with Solaris. Looking at syslog I'd see messages like:

Mar 14 10:23:24 watt imapd[5834]: [ID 853321 mail.error] SSL error status: error:140D308A:SSL routines:TLS1_SETUP_KEY_BLOCK:cipher or hash unavailable

And looking at the imapd binary I saw a missing libcrypto_extra. Searching the net I saw a bunch of people talking about it. It appears that this is no longer needed with Solaris 10, but others say that you need to install {{SUNWcry}} package. Well, I must be a loser because I could not find enough info to make it work.

So I decided to just compile up a fresh copy of OpenSSL to use to compile imapd. So here's what I did.

Compiling OpenSSL -- its pretty trivial to do, in this day and age, however my first attempt compiled it 64bit, and imapd had issues with that. There are a few extra configuration parameters to force it to 32 bit. Here's the Configure line.

Configure --prefix=/opt/openssl-0.9.8e 386 shared solaris-x86-gcc

After that.. Compile and Install...

gmake
gmake install

Compiling Imapd -- The instructions in docs/SSLBUILD go over the basics. But there were a few additional changes I needed to make. The main change was to make sure imap was built with my OpenSSL instead of the Solaris version. All these changes were to src/osdep/unix/Makefile:

Fist I set the SSLDIR and SSLCERTS variables to where I wanted them:

SSLDIR=/opt/openssl
SSLCERTS=/etc/sfw/openssl/certs

Next, I forced it to use the static version of libcrypto.a by changing SSLCRYPTO:

SSLCRYPTO=$(SSLLIB)/libcrypto.a

Finally, I need to force it to use my static version of libssl.a.

SSLLDFLAGS= -L$(SSLLIB) $(SSLLIB)/libssl.a $(SSLCRYPTO) $(SSLRSA)

After that. Simply compile it up, and install it where ever you want:

gmake gso
mkdir /opt/bin
cp imapd/imapd /opt/bin

Configuring the imapd certificate -- Thanks to Rama on the magic OpenSSL command. All that you really do is create a PEM certificate called imapd.pem in the OpenSSL certs folder:

cd /opt/sfw/openssl/certs
openssl req -new -x509 -nodes -out imapd.pem -keyout imapd.pem -days 3650

Starting imapd from inetd -- Ok well now with Solaris 10 this is done though SMF, but inetd has a conversion utility to do this. I put the following line in /etc/inetd.conf

imaps stream    tcp     nowait root     /opt/bin/imapd  imapd

Then added a line to /etc/services

imaps           1143/tcp        imap2           # Internet Mail Access Protocol v2

Then just run inetconv per instructions in inetd.conf and bob's your uncle.