Enterprise Vault™ Setting up SMTP Archiving

To obtain an SSL/TLS certificate

1. If there is only one SMTP server in the site, go to Step 6.
2. Make a backup copy of openssl.cnf which is in the Enterprise Vault installation folder, for example C:\Program Files (x86)\Enterprise Vault.
3. Open openssl.cnf for editing.
4. Uncomment the following line in openssl.cnf by removing the # from the start of the line:

   # req_extensions = v3_req # The extensions to add to a certificate request

5. Add lines to the [ v3_req ] section of openssl.cnf as shown in the following example. Specify all the SMTP servers in the site:

   [ v3_req ]
   # Extensions to add to a certificate request
   
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   
   subjectAltName = @alt_names
                   
   [alt_names]
   DNS.1 = evserver1.example.local
   DNS.2 = evserver2.example.local
   DNS.3 = evserver3.example.local
   DNS.4 = evserver4.example.local

6. Use the following OpenSSL syntax to create a certificate request and a key:

   openssl req -config openssl.cnf -new -nodes -keyout server.key -out server.csr

   Where server.key is the name of the file that will contain the certificate key and server.csr is the name of the file that will contain the certificate signing request (CSR).

   You are prompted to enter information about your organization. To leave an optional field blank, enter a period. The fields are as follows:

   • Country Name is the country in which your organization is based.

   • State or Province Name is the state in which your organization is based. Optional.

   • Locality Name is the town or city in which your organization is based. Optional.

   • Organization Name is the name of your organization.

   • Organizational Unit Name is the requesting department in your organization. Optional.

   • Common Name is the fully qualified domain name of the alias of the Enterprise Vault server to which MTAs will make SMTP connections.

   • Email Address is your email address. Optional.

   • Challenge password is an extra attribute to be sent with the certificate request. Optional

   • Optional company name is the name of the company. Optional.

   Two files are generated. You should send the CSR file to the CA, and retain the key file.

7. Next use the private key to sign the CSR.

   If there is only one SMTP server in the site, use the following command to sign the CSR:

   openssl x509 -in server.csr -out server.pem -req -signkey server.key -days 365

   If there is more than one SMTP server in the site, use the following command to sign the CSR:

   openssl x509 -in server.csr -out server.pem -req -signkey server.key -days 365 -extensions v3_req -extfile openssl.cnf

   The folder should now contain a file called server.pem, which is the server's certificate.

8. Use the following command to export the certificate and key into a PKCS#12 (.p12) file, and encrypt the file:

   openssl pkcs12 -export -in server.pem -inkey server.key -out server.p12 -descert

   When prompted, enter a password to protect the file.

   Note:

   Create a single SAN certificate that includes the fully qualified domain names of all the Enterprise Vault servers in the site. The Common Name for the SAN certificate can be the fully qualified domain name of the alias of any Enterprise Vault server in the site. When you import the SAN certificate to any one of the servers in the site, Enterprise Vault installs the certificate on the other servers.