Introduction to SSL
Introduction to SSL Implementation in IMail Server

SSL is already built into all major web browsers, and IMail Server also incorporates SSL in Web Messaging.

You can turn on IMail’s SSL feature by installing an SSL certificate using the IMail SSL Utility. You can run IMail with:

•	A self-signed SSL certificate that IMail can generate

•	An SSL certificate issued by a certificate authority such as Thawte Consulting (http://www.thawte.com) or Verisign (http://www.verisign.com).  IMail Server can generate a certificate request you can send to a certificate authority.

The SSL implementation in IMail Server is based upon the SSLeay libraries written and copyrighted by Eric Young (eay@cryptsoft.com). Portions of the implementation are copyrighted by RSA Data Security, Inc., all rights reserved.


About SSL

SSL (Secure Sockets Layer) is a protocol developed by Netscape Communications, Inc. to ensure that a client can connect securely to a  server. SSL authenticates the identity of both server and client, encrypts data, and verifies message integrity.

SSL uses “public key encryption,” a technique that uses a pair of asymmetric keys for encrypting and decrypting information. The public key is incorporated into an “SSL certificate.” The private key is never distributed; it is always kept secret. If a message is encoded using a private key, only a recipient with the corresponding public key should be able to interpret it.

For more information on how SSL works, visit http://home.netscape.com/security/techbriefs/ssl.html.)


Creating a Self-Signed Certificate

1	To create an SSL certificate:

2	Click Certificate and then click Continue when you are ready.

3	When asked if you want to create a new certificate (thus overwriting your old one) click Yes. The “IMail Certificate Creation” dialog box appears.

4	In the “IMail Certificate Creation” dialog box, do the following:

•	Enter a name for the Certificate File. The name must be comprised of eight characters and no spaces.

•	Key file. Enter file name for your private key file. By default this is the file name you entered for the certificate file. The name must be comprised of eight characters and no spaces.

•	Host Name. Enter the name of the mail host.

•	Administrator e-mail. Enter the system administrator’s e-mail address.

•	Enter your Department, Organization, City, State, and the two-letter code that represents your Country.

•	Challenge. Enter your password and Confirm it.

1	Click OK. The IMail SSL Utility immediately creates the following:

•	A self-signed SSL certificate

•	A private key file (.key) that will remain on the IMail Server system.

•	A certificate request (a file with a .csr extension) you can send to a certificate authority to request a third-party certificate.


Getting a Signed SSL Certificate

You will usually find a certificate application form on the web site of whichever certificate authority you choose. If the application form offers the “Apache/SSL” option, be sure to select it. Along with the application, you must send the .csr file generated by the IMail Server SSL Utility.

The certificate authority will return a signed certificate file to you. When you receive it, do the following:

1	Delete the old .crt file from the IMail directory.

2	If the signed certificate file does not have a file extension of .crt, open the file in text editor and then save the file in the IMail directory as a text file with a file extension of .crt.


Configuring SSL

Configuring SSL involves three steps:

1	Configuring the certificate and key files

2	Specifying ciphers

3	Entering session parameters


Configuring the Certificate and Key Files

1	If you are not already in the “Certificate and Key Files” dialog box, select SSL Configuration from the Configuration menu.

2	The Certificate box should show the path and file name of your certificate (.crt) file. By default, the path is the IMail directory and the filename is one of the following:

•	If you are using a self-signed certificate, enter the name of the .crt file name you created.

•	If you have a file from a certificate authority, enter the .crt file name of the signed certificate file.

1	In the Key File box, enter the path and file name of your private key (.key) file. By default, this is the IMail directory and the name you specified when you created the self-signed certificate.

3	Enter a Password and confirm it.

4	Click Next and enter the ciphers.


Ciphers

When a connection is established between a client and the web server, the client can use any one of a number of cipher specifications to perform the SSL handshake. The “Cipher” dialog box is where you indicate which cipher specifications are acceptable. If the client doesn’t use one of these, the IMail web server will reject the client connection. The supported ciphers are stored in a file named cipher.dat.

To specify acceptable cipher specifications:

1	If you’re not already in the “Cipher” dialog box, select SSL Configuration from the Configuration menu and then click the Next button. You see the Cipher panel of the “Configuration” dialog box.

2	Move at least one cipher specification from the list on the right to the list on the left (“Supported Ciphers”)

3	Click Next and set the session parameters.


Setting Session Options

In IMail Server, SSL caches connection information for each active client (a client that is currently connected to the web server). If a client logs off and then logs on again, the client’s browser may request to use the previous connection information; this would eliminate the need for handshaking again. You can control the number of active connections as well as the maximum time to allow for an inactive connection before disconnecting.

1	If you’re not already in the “Cipher” dialog box, select SSL Configuration from the Configuration menu and then click the Next button twice. You see the Session Parameters panel of the Configuration dialog box

2	In the Session Cache Size box, enter the maximum number of sessions to cache. If this number is exceeded, the oldest sessions are deleted from the cache.

3	Enter the Session Time Out for each session stored in the cache. After this period of time, the client login is considered invalid. If any request comes for that session, then a full handshake takes place.


Authenticating Clients

The IMail web server authenticates a client by requesting and examining the client's certificate.

You can set up client authentication in several ways:

•	You can require all web server clients to have an SSL certificate.

•	You can ask if the client has a certificate and, if they do, authenticate the certificate that is presented.

•	You can let anyone log on to the IMail web server whether or not they have a certificate.

To specify how SSL will authenticate clients:

1	If you are not already in the Client Authentication dialog box, select Client Authentication from the Configuration menu.

2	To have IMail request a client certificate when a user logs on to the web server, turn on Client Authentication. If you want IMail to let anyone log on whether or not they have a certificate, turn this off and skip the next two steps.

3	To have IMail validate a client certificate if the client presents one (and allow users without a certificate to log on), turn on Continue if no client certificate.

4	To have IMail require a valid client certificate, turn off Continue if no client certificate.

You can also require client certificates from specific IP addresses. The IP addresses can be for specific computers or for a domain.


Requiring Certificates from Specific IP Addresses

You can have the Web Messaging server require an SSL certificate from specific computers or from a domain.

1	If you are not already in the Client Authentication dialog box, select Client Authentication from the Configuration menu.

2	Do one or both of the following:

•	To require an SSL certificate from a particular IP address, enter the address and subnet in the IP Address and Subnet boxes, and then click Add. Repeat for each IP address from which you want to require a certificate.

•	To import from a file a list of IP addresses that will require certificates, enter a path and file name in the Import IP List From box and then click Import. The IP addresses in the file appear in the List of IP Addresses list box on the left.

3	Move the addresses that will be required to have a certificate from the list on the left to the Certificate Request list on the right.

The IP addresses which will require certificates (the ones in the list on the right) are stored in a file named IPAddress.txt. This file is stored in the same directory as the IMail SSL Utility. The format of this file is IPAddress,SubnetMask. For example:

192.168.1.0,255.255.255.0

192.168.1.3,255.255.255.0

4	Click OK.


About Logging Options

SSL can generate four different logs:

•	The default log (log.log) is created in the specified log file path. You can change the name and specify a maximum size.

•	Error log (error.log). This optional log records all SSL errors. You cannot change the name of this file, but you can specify a maximum size.

•	Session log (sess.log). This optional log contains session information (such as ciphers chosen, time started, etc.) from the current IMail SSL Utility session. You cannot change the name of this file, but you can specify a maximum size.

•	Raw Packet log (raw.log). This optional log tracks packets to and from a connected client. You cannot change the name of this file, but you can specify a maximum size.

You configure log files in the fourth panel of the SSL Configuration dialog box.


Configuring Log Files

To configure log files:

1	Select Logging options from the Configuration menu.

2	If you want a default log, turn on Default log. If you like, enter a new Name and Maximum Size for the default log.

3	If you want an error log, turn on Error log, and enter the maximum size.

4	If you want a session log, turn on Session log, and enter the maximum size.

5	If you want a raw packet log, turn on Raw Packet Log, and enter the maximum size.

6	Click Next.

Related topics

About Logging Options


Specifying the Registry Path

To specify a registry path:

1	Start the IMail SSL Utility.

2	Select Registry Path from the File menu.

3	Type the path of your registry entries. [If you are using the standard/default path, enter the following:

software\ipswitch\imail\ssl

This path is stored in the Windows registry under HKEY_LOCAL_MACHINE.


Authentication (definition)

Client authentication checks the certificate to make sure it has a valid date; however it does not check the certificate authority who has issued the client certificate for a valid public key, nor does it check the certificate to see if it has been revoked.


Self-Signed SSL Certificate (definition)

This is a file (with a .crt extension) created by the IMail SSL Utility. This certificate will be given to all clients who try to log on to the IMail server. The certificate is ready to use as is. However, when attempt to log on, they will get a warning that the Certificate Issuer is “untrusted” or “unknown.”


Cipher (definition)

An algorithm used to encrypt data.


Certificate Authority (definition)

Certificate authorities issue digital certificates and validate the holder's identity and authority. They embed an individual's or an organization's public key along with other identifying information into each digital certificate and then cryptographically ‘sign’ it, verifying the integrity of the data within it, and validating its use.


Certificate (definition)

A SSL certificate is a digital file (with a .crt file extension) comprised of:

•	An individual's or an organization's public key

•	Other identifying information about the individual or organization, and about the certificate authority

•	An encrypted signature of the issuing authority

An SSL certificate is made public by distributing it widely or presenting it when requested.


CSR File (definition)

A CSR file is a "Certificate Signing Request," a file that has a .csr file extension.