SSL Rant

GAAAAAAAAHHHH I HATE SSL

Well, I mean, I cannot live without ssl. Well I mean, I cannot live without encryption. And SSL is the de-facto standard encryption on the internet.
Since I moved to a new server because the old ones uptime rarely gets beyond 24 hours these days, i had to reconfigure some services. Apache was easy, copy the config, everybody's happy.
Mail wasn't that easy, I wanted to have virtual domains. So I had to bake myself a new little setup from ground up. postfix + courier-imap was working before, so I decided to base it on that.
But when I was testing connectivity I noticed SSL warnings. these typical "your certificate is BROKEN" in your face warnings, that would make everybody besides myself check for new viruses on their pc while making sure the abort button is not some evil "sell your soul here" button.
I don't reaaaaaally need to get rid of the warning but I wanted to do it right. It seems I used cacert certificates before. They are really nice, but aren't really compatible with anyone who doesn't go to keysigning parties or at least knows what that is. So I took my already working StartCom SSL certificate, that I use for apache and mumble, pointed the config file to it and then screamed and shed tears of blood for the next couple of hours.
Because supplying your own certificate isn't enough. No, you have get the right combination of internmediate certificates, root certificates, your own public one and your private key. And just as a side note: EVERY program does is differently! So went to the internets and looked, which files I had to cat together four courier-imap, but instead of the gaping abyss of result-less google searches I got about 10 different possiblilites, which certificates to cat together. Also, there is the ascii-style .pem format and the .crt format. Or .crt formats. Because some .crts look exactly like .pems and some are binary garbage. And people are just throwing them together in files and one never knows, if the time they did this, a .crt had a .pem format or not.
Oh, did I mention? The order in which you pack these little freaky buggers together make a difference. Sometimes.

So.
What I want to say. To every body who writes config parsers and ssl apis. PLEASE make this easier. make one option for every kind of file. Try to look up intermediate certificates your self, so we don't have to supply them. To the SSL providers: provide these intermediate certificates!

And for all the lost courier-imap - configurating people out there:
TLS_CERTFILE -> make this point to a file that includes your public and private certificate (.pem)
TLS_TRUSTCERTS -> make this point to a file that includes first the intermediate certificate, then the root certificate (if that order make a differnce - I don't know, I don't care anymore)

Mumble Server and SSL

Here we are again,

my friendly gentoo server and me, playing "wouldn't be fun without trouble" ;)
Goal:
- murmur as a Mumble server
- startcom / startssl class 1 certificate
Problem:

sslCert=/etc/ssl/startssl/server.pem
sslKey=/etc/ssl/startssl/server_key.pem
did not do the trick. Though it only throws error when you try to connect.
Then I tried different variants of cat-ing together cert and key, cert and intermediate authority, with ca itself, all of it, no luck at all.
Thanks to: http://www.mumb1e.de/de/gemeinde/forum/7-murmur/1151-ssl-zertifikat I tried the right thing:
sslCa=/etc/ssl/startssl/chain.pem
Where chain.pem just contains the ca and the intermediate cert of startcom. sslCert is only my cert and sslKey is only my key.
Hope I saved someone an hour with google ;)