Fix mistakes with OpenSMTPD client certificates

1 files changed, 6 insertions, 19 deletions

diff --git a/content/blog/2020/email-server-extras.md b/content/blog/2020/email-server-extras.md
index cf3b597..9e18f34 100644
--- a/content/blog/2020/email-server-extras.md
+++ b/content/blog/2020/email-server-extras.md
@@ -8,7 +8,7 @@ This sequel to my earlier [guide](/blog/2020/email-server/) discusses
 extra tips and tricks to extend your email setup.
 This page will be updated continuously as I come up with ideas.
 
-Last updated 2020-04-27.
+Last updated 2020-04-29.
 
 
 ## General
@@ -114,17 +114,10 @@ and will conclude that the recipient is invalid.
 
 ## OpenSMTPD
 
-### Client certificates
+### Client certificates (in addition to passwords)
 
 You can configure OpenSMTPD to request a client certificate
-for sending emails, in addition to or as a subsitute for passwords.
-In this guide I'll use it for subsitution.
-
-This is especially useful if you created a catch-all inbox,
-since this approach allows you to send messages from arbitrary names,
-as long as the client can present a valid certificate.
-It also allows you to get rid of the awkward duplication
-of user credentials between Dovecot and OpenSMTPD.
+for sending emails, as a second factor for authentication.
 
 
 #### Creating certificates
@@ -187,19 +180,15 @@ and declare it to OpenSMTPD by adding this near the top of the file:
 ca "mailca" cert "/etc/smtpd/mailca.crt"
 ```
 Then replace the entire configuration for outbound mail as follows.
-Note that this removes SMTPS support, leaving only STARTTLS,
-and that it also removes the need to enter a password:
+Note that this removes SMTPS support, leaving only STARTTLS:
 ```sh
 # Outbound
-listen on eth0 port 587 tls-require verify pki "example.com" ca "mailca" filter "rspamd" tag "VALID"
+listen on eth0 port 587 tls-require verify pki "example.com" ca "mailca" auth <passwds> filter "rspamd"
 action "SEND" relay srs
-match from any tag "VALID" for any action "SEND"
+match from any auth for any action "SEND"
 ```
 The magic word here is "`verify`", which tells OpenSMTPD
 to ask for a client certificate and to verify it using the given CA.
-The `tag "VALID"` at the end is to clarify that all emails
-that successfully pass through the first line are from trusted senders,
-because they presented a valid client certificate.
 
 
 #### Client configuration
@@ -221,5 +210,3 @@ $ openssl pkcs12 -export -in mailclient.crt -inkey mailclient.key \
 OpenSSL will ask you to set a password, which you'll need to
 enter again when importing the certificate into the client.
 
-
-