Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cannot specify tls_client directive #674

Open
pidario opened this issue Jan 26, 2024 · 4 comments
Open

cannot specify tls_client directive #674

pidario opened this issue Jan 26, 2024 · 4 comments
Assignees
Labels
bug Something isn't working. ready-for-release Feature is implemented and available for testing in dev branch. It will be included in the next rele

Comments

@pidario
Copy link

pidario commented Jan 26, 2024

Describe the bug

Given the documentation found here I assumed I could specify a global tls_client directive but instead I get this error:

/etc/maddy/maddy.conf:21: unknown module or global directive: tls_client

Steps to reproduce

Add a tls_client directive in the global scope.

Configuration file

Default configuration file, with just the added tls_client block, as below.

...

# Base variables
$(hostname) = example.com
$(primary_domain) = example.com
$(local_domains) = $(primary_domain)

tls file /etc/maddy/cert.pem /etc/maddy/key.pem {
    protocols tls1.2 tls1.3
    curves X25519
}

tls_client {
    protocols tls1.2 tls1.3
    curves X25519
    root_ca /etc/maddy/ca.pem
 }

# ----------------------------------------------------------------------------
# Local storage & authentication
...

Environment information

  • maddy version: 0.7.1

Thanks in advance for your answer and for making email deployment a simple task.

@pidario pidario added the bug Something isn't working. label Jan 26, 2024
@foxcpp foxcpp self-assigned this Jan 26, 2024
foxcpp added a commit that referenced this issue Jan 27, 2024
@foxcpp
Copy link
Owner

foxcpp commented Jan 27, 2024

Oops, fixed in dd06ffe.

You can build maddy from source from master branch or just move tls_client into target.remote block:

target.remote outbound_delivery {
  tls_client {
    protocols tls1.2 tls1.3
    curves X25519
    root_ca /etc/maddy/ca.pem
  }
}

@foxcpp foxcpp added the ready-for-release Feature is implemented and available for testing in dev branch. It will be included in the next rele label Jan 27, 2024
@pidario
Copy link
Author

pidario commented Jan 27, 2024

Building from source gets rid of the error. But I cannot get maddy to enable TLS client authentication. Probably I should have mentioned before that I wanted to achieve that.
I expected cert to be the certificate presented by the server to any client connecting and key its private key (and that seems to be the case); but then I also expected root_ca to be the certificate authority that needs to be used to sign client certificate but it seems that, even though I specified all three properties, maddy allows the connection from any client.
Docs mention that.
The three pem files I used works as expected for connecting to a redis server.
What do I need to do it? Would you prefer to open a separate issue for that?

@foxcpp
Copy link
Owner

foxcpp commented Jan 27, 2024

Docs probably should be clarified, tls_client configures maddy's TLS client - that is, when maddy connects to other SMTP servers. While maddy can be configured to use TLS authentication while talking to other servers, currently it does not support it server-side.

What is your use-case? It is very easy to add functionality to validate client certificates, but full authentication support definitely will take more work.

@pidario
Copy link
Author

pidario commented Jan 27, 2024

Ah that now makes more sense! Thanks for the clarification.
My use case is basically using a more secure authentication method for imap and submission.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working. ready-for-release Feature is implemented and available for testing in dev branch. It will be included in the next rele
Projects
None yet
Development

No branches or pull requests

2 participants