Nigel Metheringham edited this page Nov 30, 2012 · 3 revisions



I am trying to set up an Exim server that uses a self-signed certificate to enable my clients to use TLS. However, clients other than Exim refuse to accept this certificate. What's wrong?


It seems that some clients require that the certificate presented by the server be a user (also called leaf or site ) certificate, and not a self-signed certificate. In this situation, the self-signed certificate must be installed on the client as a trusted root certification authority (CA), and the certificate used by the server must be a user certificate signed with that self-signed certificate. For information on creating self-signed CA certificates and using them to sign user certificates, see the General implementation overview chapter of the Open-source PKI book, available online at Here is a quick overview. First, read this message: Then, follow the instructions found on these two (consecutive) pages: Two points on the PKI Book literature:

  1. It's assumed that it's okay to use a passphrase-protected key to encrypt the user/site/leaf certificate. If this isn't acceptable, you seem to be able to strip out the passphrase as follows:
openssl rsa -in user.key -our

This should be done immediately after user.key is created.

  1. The script is available in the mod_ssl distribution, available at

Having followed the instructions, you end up with the following files: (a) ca.crt This file should be installed into the client software as a trusted root certification authority. In Windows XP, this can be done as follows:

Call the file ca_cert.cer br_ Double-click on the file br_ "Install Certificate"; br_ "Next" br_ "Place all certificates in the following store" br_ "Browse..." br_ "Trusted Root Certification Authorities" br_ "OK" br_ "Next" br_ "Finish" br_ "Yes" br_ "OK"

(b) user.crt and user.key These files should be installed into the server software. In Exim, this can be done by adding these lines to the configuration file:

tls_certificate = /usr/local/etc/exim/tls_cert
tls_privatekey = /usr/local/etc/exim/tls_key

Then install user.crt and user.key under the names tls_cert and tls_key in the appropriate directory.

Clone this wiki locally
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.