cert issue on daemon start

[packeteer]

hey, I get this issue after initial config, when trying to start Stalwart

Mar 05 02:21:58 vps01 stalwart-smtp[2681]: Configuration error: Failed to build RSA key for signature.rsa.private-key: Cryptography layer error: No RSA key found in PEM
Mar 05 02:21:58 vps01 systemd[1]: stalwart-smtp.service: Main process exited, code=exited, status=1/FAILURE

any idea where I should start looking?

[mdecimus]

Hi,

Are you using the keys that were generated automatically by the install program or your own DKIM keys? In any case, please open the /usr/local/stalwart-smtp/etc/config.toml and look for the [signature."rsa"] section, it should look like this:

[signature."rsa"]
#public-key = "file:///usr/local/stalwart-smtp/etc/certs/dkim.crt"
private-key = "file:///usr/local/stalwart-smtp/etc/private/dkim.key"

Then check the contents of the private key file configured in private-key, it should begin with -----BEGIN RSA PRIVATE KEY-----.

You can also try generating a new DKIM key as follows:

openssl genrsa -out /usr/local/stalwart-smtp/etc/private/dkim.key 2048
openssl rsa -in /usr/local/stalwart-smtp/etc/private/dkim.key -pubout -out /usr/local/stalwart-smtp/etc/certs/dkim.crt

And to obtain the public key for the DKIM DNS entry use:

openssl rsa -in /usr/local/stalwart-smtp/etc/private/dkim.key -pubout -outform der 2>/dev/null | openssl base64 -A

[smorks]

i'm having the same issue. i'm using the keys that were generated automatically by the install program.

i noticed that when running the openssl genrsa command, my private key starts with -----BEGIN PRIVATE KEY-----, rather than what you have above (ie it doesn't say RSA PRIVATE KEY).

i will play around with it a bit more to see if I can narrow down the issue.

[smorks]

this appears to be an openssl 3 issue. according to: https://stackoverflow.com/questions/20065304/differences-between-begin-rsa-private-key-and-begin-private-key#comment132991589_20065522

with openssl 3, you need to pass the -traditional parameter in order to create the correct format of private key.

[mdecimus]

Does it work when using -traditional? In any case I'll report this to the rustls crate as they should support both formats.

[smorks]

yes, it works when using -traditional

[Dennis-Zhang-SH]

HI, I think maybe you use the wrong function? As the question was asked almost 10 years ago, I think rustls should support both of them.

[Dennis-Zhang-SH]

https://docs.rs/rustls-pemfile/1.0.2/rustls_pemfile/enum.Item.html#variant.PKCS8Key

You probably need to add a format in config toml and parsing the pem file in PKCS8 key.