Postfix & Courier & Letsencrypt

First of all, create your certificates (the regular way). I created one with multiple domains:,,

In my case, as the mailserver and webserver are behind a proxy (postfix, imap, Roundcube Webmail), I create the certificate on the proxy (nginx) and scp the cert to the mail server. All this is automated with a tiny script.

For Postfix, edit and change/edit/add these lines (check the right path too!):

smtpd_use_tls = yes
smtpd_tls_key_file = /etc/ssl/letsencrypt/webmail.privkey.pem
smtpd_tls_cert_file = /etc/ssl/letsencrypt/webmail.fullchain.pem
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_exchange_name = /var/run/prng_exch
tls_random_source = dev:/dev/urandom
smtpd_tls_dh1024_param_file = /etc/ssl/postfix/dhparams.pem
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

And restart postfix: /etc/init.d/postfix restart

As for Courier you’ll need to concatenate the files (again, check the path, it’s most likely /etc/letsencrypt/live/domain/xyz.pem):

cat /etc/ssl/letsencrypt/webmail.privkey.pem /etc/ssl/letsencrypt/webmail.fullchain.pem > /etc/ssl/letsencrypt/webmail.all.pem

Then edit both /etc/courier/pop3d-ssl and /etc/courier/imapd-ssl

And add/change the path of the certificate:


And restart Courier: /etc/init.d/courier-imap-ssl restart && /etc/init.d/courier-pop-ssl restart

Belgian banks & SSL — part 5

Minor end of year update. No big SSL exploits have been released since (bar DH, see below).

Once again, this is testing the public websites I can access. There might be other gateways, APIs, etc that are not (as) secure.

It’s worthy to note that some banks are serious about security and fixing their SSL. Most improved their rating and solved all issues (especially getting rid of SHA1 in the chain). However, a couple lowered from B to C (see below). But… No more F’s. 🙂

The noteworthy changers:

  • Hello Bank! went from A to B though due to weak DH,
  • Triodos lost their Forward Secrecy,
  • Optima from F to A(-) (and a bunch others from B to A, and higher),
  • A bunch from B to C due to SSLLabs being more severe (see below). Most did solve some of their issues,
  • BKCP is doing a lot wrong.

Edit: Tested wrong AXA domain; updated to A+.

Update 11 Jan 2016: ABK & BvB updated to A.

Note that not supporting TLS 1.2 or supporting RC4 capped sites to grade B about a year ago; it now caps to grade C (aka SSLLabs is more severe).

Grade A

Grade B

Grade C

  • PSA Bank: weak signature (SHA1), no TLS 1.2, no Forward Secrecy.
  • beobank: weak DH, no TLS 1.2, RC4 (insecure), no Forward Secrecy, no secure renegotiation.
  • BKCP: weak signature (SHA1), no TLS 1.2, RC4 (insecure), no Forward Secrecy, weak DH.

Grade D

  • n/a

Grade E

  • n/a

Grade F

  • n/a

Waze not getting a GPS fix

TL;DR: recalibrate your compass.

I’ve come across an issue for the past 10 days that Waze kept losing its GPS fix. This meant:

  • constantly switching between 0 and 120 (or whatever) km/h
  • constantly zooming in & out on maps (dynamic zoom level depending on speed)
  • being in a field/not on the road for most of the time, or stuck to a location of many minutes ago
  • often & randomly losing GPS fix (ie middle of the highway without any buildings blocking the line of sight)
  • I could do a 45 minute trip with Waze never getting a GPS fix
  • not knowing road issues (accidents, traffic jams ahead, speed traps, etc)

Things I tried:

  • nothing changed (no new car window, didn’t move my phone location in the car, etc)
  • not moving (ie parked car) didn’t really improve the GPS fix
  • even left my phone with Waze on in the car for 30 minutes parked (got a fix, but later that evening when driving home it started to lose its GPS fix again)
  • clear Waze cache
  • uninstall Waze completely
  • GPS Essentials showed a fix with 3 or more GPS satellites when Waze couldn’t get a fix
  • I was about to find a way to reset my GPS and/or clear its cache (???)

PS: I have had this issue in the past (I believe with the same phone, a Nexus 5), but it went away after several days.

What I did notice, however, is that in Google Maps the arrow (clicking the pin point button twice or something) was pretty much showing the opposite direction of how the car was moving (thus driving backwards at ~120km/h). This made me think, as I know the GPSes in smartphones are quite cheap and aren’t always on (to save battery — my phone is always being charged in the car though) and the phone uses the accelerometer and other sensors to “guess” current path (or rather, path changes, ie taking a turn or slowing down/accelerating).

I then recalibrate my compass using this method with the free app GPS Essentials (compass tab). I noticed two things

  • my compass was showing south as north
  • calibrating it in my room (no known magnets here) gave a mixed result (it sometimes pointed north, and sometimes stopped doing so)
  • moving around gave me a better calibration (more accurately pointing north)
  • question? Is the compass chip fucked? broken? cheap ass crap?

Trying now again driving around with Waze:

  • Waze almost instantly has a GPS fix
  • Waze doesn’t lose its GPS fix most of the time but …
  • Waze still occasionally loses its fix (but regain it after a second or two, three)

So it’s not always a GPS issue, but rather an issue with one of the other sensors (what here seems to be the compass).

Edit: the problem comes back after ~1 day. Compass often stuck and doesn’t really point north. Ever. Calibrating sometimes helps, but it ends to get stuck again after a while. Nexus 5 chipset issue? Google Navigation works (way) better (it doesn’t remain at the same location for ~10 minutes), but it’s not very precise either (always lagging behind a a street or cross road or something). Perhaps Google Navigation is better at using GSM localisation and doesn’t use the compass to figure out so much?

Edit 2: It works “fairly ok” if I calibrate my compass just before driving. It still loses its fix a few times, but all in all it was acceptable.

I’ve seen in tools like GPS Status that north always points to the bottom right (“south east”) unless it finds a GPS fix. When it’s stuck “finding GPS location” my compass is entirely off and Waze is seeking a fix. When it has a GPS location Waze is fine.

Note that while it cannot find a GPS location, it does have a fix with 3+ GPS satellites.

So I’m not sure if it’s a compass issue, or a GPS issue, and what the definite difference is between both (a smartphone compass not being a magnetic compass if I understand correctly).