Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.19

http-tls-ca-file

Globalrestart required

A file of trusted authorities for the web monitor's client certificates
in the configuration this is a linehttp-tls-ca-fileinside the block Global
Whom the monitor trusts at the entrance

A PEM file with certificate authority certificates. The monitor uses them to verify the certificate the client sent, if it requested one via http-tls-request-client-certificate. The line has no default.

The monitor does not take its own certificate here. This is the only place in the configuration where encryption is configured without a certificate line: receiving mail has one (smtp-server-tls-certificate), so do the listener and the Transmissions API input, but the monitor does not. Its certificate lies in a file — /var/lib/pmta/webmon.pem on Unix, db\webmon.pem in the installation directory on Windows (§ 5.1).

The monitor issues a self-signed certificate for itself during installation. We checked this on a fleet node: the handshake delivers a certificate whose common name is the host name, and chain verification predictably fails. It can be replaced with a real one in only one way — overwrite the file and restart the monitor; there is no configuration line for this.

A practical conclusion for the fleet. Giving the monitor a certificate is not a configuration edit but delivering a file plus restarting the service. It is a separate operation, and it is not part of applying the configuration.

The main trap is looking for your own certificate here. The line’s name resembles tls-certificate, and the node’s own certificate gets put into it. The monitor will not pick it up: the line is about other people’s certificates, about whom to trust at the entrance.
What the Hub does. It does not write it: nobody connects to the monitor with client certificates. Replacing the monitor’s self-signed certificate with a real one is not automated here either — it is delivering a file and restarting the service, as a separate task.
Recommended values

The line is needed only where clients present a certificate:

Value When
do not set (default) clients connect with the management key
path to PEM clients present their own certificate

The monitor’s own certificate is not set here, but by the file /var/lib/pmta/webmon.pem.

The PEM format and the purpose of the file are from the manual (§ 3.3.1.58.19). The path to the monitor’s own certificate and the way to replace it are from there too (§ 5.1). That the certificate is self-signed and issued for the host name is our check on a fleet node.
Example configuration
# trusted authorities for client certificates
http-mgmt-port 1000
http-tls-ca-file /etc/pmta/certchain.pem
The manual’s example. The monitor’s own certificate is not set by this line — it lies in the file /var/lib/pmta/webmon.pem.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Putting the monitor's own certificate into the line

our experience

What it costsThe monitor will not pick it up: the line sets trusted authorities for other people’s certificates. It takes its own from the webmon.pem file.
How to spot itThe line is set, but the browser still complains about the self-signed certificate.
How to do it rightOverwrite /var/lib/pmta/webmon.pem and restart the monitor.

Changing the certificate file and reloading the configuration

our experience

What it costspmta reload does not touch the monitor. The new certificate lies on disk and is not presented.
How to spot itThe file has been replaced, but the handshake shows the old certificate.
How to do it rightRestart the web monitor.

Setting the file while the client certificate request is turned off

§ 3.3.1.58.19

What it costsThere is nothing to verify: with http-tls-request-client-certificate false the client sends no certificate. The request defaults to true.
How to spot itThe file is set, but the monitor log has not a single verification.
How to do it rightTurn the request back on (default true) or remove the line.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-tls-ca-file <path>
Values
path to a PEM file
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, the Global section, and applies to the node’s whole management interface.
⇄

Related directives

2 relations

Works together with

http-tls-request-client-certificateGlobalWithout a certificate request this file has nothing to verify. inference

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.19

How to check on the node
First we look at which certificate the monitor presents itself — it immediately shows whether it is self-signed or real:
openssl s_client -connect NODE:1000 -brief </dev/null
verify error:num=18:self-signed certificate — the certificate from installation is in place. Peer certificate: CN=… shows the name it was issued for. The trusted authorities file itself is checked with the command openssl crl2pkcs7 -nocrl -certfile FILE | openssl pkcs7 -print_certs -noout.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:smtp-server-tls-certificateopenssl-security-levelsmtp-server-tls-min-versionhttp-tls-min-versionsmtp-server-tls-cipher-server-preferenceAll 108 directives of the block →