<!DOCTYPE html><html><head><title></title><style type="text/css">#qt p{white-space:pre-wrap;}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div><br></div><div><br></div><div>On Thu, Jan 23, 2020, at 19:18, Andreas Günther wrote:<br></div><blockquote type="cite" id="qt"><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">Am Mittwoch, 22. Januar 2020, 19:44:55 CET schrieb Stephan Brunner:<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">> Hallo Andreas,<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">><br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">> wenn das dein richtiger PrivateKey unten ist, dann solltest du sofort<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">> das Zertifikat sperren lassen, und das Zertifikat mit einem neuen<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">> Schlüssel anfordern.<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">><br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">> Grüße<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">><br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">> Stephan<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">Hallo Stephan,<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"> <br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">das sowieso. Jetzt will ich erst mal das Problem gelöst wissen.<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;">Ich glaube, das Problem liegt bei<br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"><span style="background-color:rgb(48, 48, 48)" class="highlight"><span style="color:rgb(255, 255, 255)" class="colour"><span style="font-family:monospace" class="font">ssl_dh = </etc/dovecot/dh.pem</span></span></span><br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"><span style="font-family:monospace" class="font">denn</span><br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"><span style="background-color:rgb(48, 48, 48)" class="highlight"><span style="color:rgb(255, 255, 255)" class="colour"><span style="font-family:monospace" class="font">openssl rsa -noout -text -in dh.pem </span></span></span><span style="font-family:monospace" class="font"><br>unable to load Private Key <br>140276678587520:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY</span></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"><span style="background-color:rgb(48, 48, 48)" class="highlight"><span style="color:rgb(255, 255, 255)" class="colour"><span style="font-family:monospace" class="font">ssl_key = </etc/ssl/mail/mail.key</span></span></span><span style="font-family:monospace" class="font"><br>ist ein Link auf den LetsEncrypt-Key.</span></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"> <br></p><p style="margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;text-indent:0px;"><span style="font-family:monospace" class="font">Ist jetzt </span><span style="background-color:rgb(48, 48, 48)" class="highlight"><span style="color:rgb(255, 255, 255)" class="colour"><span style="font-family:monospace" class="font">dh.pem komplett unabhängig von dem Let</span></span></span><span style="font-family:monospace" class="font">sEncrypt-Schlüssel/Zertifikat, welches für den Mailserver insgesamt gilt?</span><br></p></blockquote><div><br></div><div>Ja. Die DH-Parameter sind für den Key Exchange. Aber es braucht jemand anderes der mehr Ahnung von Kryptographie hat, um zu erklären was genau ihr Part ist (irgendwas um ein Shared Secret zwischen beiden Parteien auszutauschen)<br></div><div><br></div><div>Niels</div><div><br></div></body></html>