Administrator's Guide - Kerio Software Archive

Chapter 10Server’s CertificatesThe principle behind secure services in Kerio MailServer (services encrypted by SSL — e.g.HTTPS, IMAPS, POP3S, etc.) is that all communication between the client and the server isencrypted to protect it from tapping and to prevent it from misuse of transmitted information.The SSL encryption protocol used for this purpose uses an asymmetric cipher first to exchangea symmetric key.The asymmetric cipher uses two keys: a public one for encrypting and a private one for decrypting.As their names suggest, the public (encrypting) key is available to anyone wishing toestablish a connection with the server, whereas the private (decrypting) key is available onlyto the server and must remain secret. The client, however, also needs to be able to identifythe server (to find out if it is truly the server and not an impostor). For this purpose there isa certificate, which contains the public server key, the server name, expiration date and otherdetails. To ensure the authenticity of the certificate it must be certified and signed by a thirdparty, the certification authority.Communication between the client and server then follows this scheme: the client generatesa symmetric key and encrypts it with the public server key (obtained from the server certificate).The server decrypts it with its private key (kept solely by the server). This methodensures that the symmetric key is known only to the server and client.Note: To secure Kerio MailServer as much as possible, allow only SSL-secured traffic. Thiscan be set either by stopping all unencrypted services (see chapter 6) or by setting appropriatesecurity policy (refer to chapter 15.6). Once the server is configured, it is necessary toinstall a certificate (even a self-signed one) or certificates on clients of all users using KerioMailServer’s services.10.1 Kerio MailServer CertificateTo find out how these principles work in practice, look at Secure HTTP. Web browsers candisplay certificate information, as opposed to Secure POP3 or Secure IMAP, where such informationwill not be revealed.When Kerio MailServer (version 6.0 and above) is run for the first time, it generates the selfsignedcertificate automatically. It is saved in the server.crt file in the sslcert folder whereKerio MailServer is installed. The second file in this directory, server.key, contains theserver’s private key.If you attempt to access the Secure HTTP service immediately after installing Kerio MailServera security warning will be displayed with the following information (depending on yourbrowser, name of the computer, etc.):84