On Wed, Dec 08, 2021 at 07:49:14AM -0500, [email protected] wrote:
> Thanks for your help. > > I was able to 'confirm' the certificate in Thunderbird. > > > > I looked at the certificate in Thunderbird. As I knew, it is a chain of > multiple domains, all set up on our VPS. > > Under Issuer Name it says: Common Name R3 > > It appears that I'm able to connect to the mailbox now but I can’t receive or > send email. > > Thunderbird says: > Wrong Site The certificate belongs to a different site, which could mean that > someone is trying to impersonate this site. > > In Thunderbird I can Confirm Security Exception but I’d much rather fix the > problem. I think this is because the certificate at mail.sizzelicks.com doesn't certify that domain. You can either add mail.sizzelicks.com to the list of domains that are certified by that certificate (e.g., with certbot's -d option), or tell Thunderbird to connect to sizzelicks.com instead of mail.sizzelicks.com (since the certificate does certify sizzelicks.com). But adding the sizzelicks.com's MX domain (mail.sizzelicks.com) is the better option. You can see this with: > echo | openssl s_client -showcerts -servername mail.sizzelicks.com -connect mail.sizzelicks.com:995 2>/dev/null | openssl x509 -inform pem -noout -text | grep DNS: DNS:aecperformance.com, DNS:deanhh.com, DNS:dev.aecperformance.com, DNS:sizzelicks.com, DNS:softlinksys.com, DNS:www.aecperformance.com, DNS:www.deanhh.com, DNS:www.sizzelicks.com, DNS:www.softlinksys.com If you are using certbot, this can be done with a command like: sudo certbot certonly -d aecperformance.com,deanhh.com,dev.aecperformance.com,sizzelicks.com,softlinksys.com,www.aecperformance.com,www.deanhh.com,www.sizzelicks.com,www.softlinksys.com,mail.sizzelicks.com But check the Certbot documentation (or whatever ACME client you are using). I might be wrong. Maybe "certonly" should be "run" but I don't think so. That's only if there is a virtual website for mail.sizzelicks.com. The main thing is to include all of the existing domains as well as the domain being added (mail.sizzelicks.com). But you will also need to include any other ACME authentication-related options that you used originally (e.g., --apache or --nginx). cheers, raf > The certificate is for a 'chain' of domains, 5 as of now, with the > primary domain being aecperformance.com (not sizzelicks.com). > > The certificate as shown in Thunderbird says: Common Name > aecperformance.com > > The certificate does show a list of all the domains in the chain. > > > > Our VPS hosts multiple domains (5 right now) all of which receive and send > email. > > The websites on the VPS all work fine under ssl using the same certificate > chain set up in postfix/dovecot config. > > > > When I install postfix and dovecot the configuration includes paths for 1 > certificate. > > The certificate files I have set in postfix & dovecot config are the > letsencrypt files for the websites. > > > > How should I set up the certificates for the domains that postfix/dovecot > handles? > > How can I fix the problem Thunderbird is having with the certificate chain of > multiple domains? > > > > > > -----Original Message----- > From: dovecot <[email protected]> On Behalf Of Robert L Mathews > Sent: Tuesday, December 7, 2021 7:46 PM > To: [email protected] > Subject: Re: Mailbox connection fails: Connection closed (No commands sent) > Help please > > > > On 12/7/21 2:49 PM, Alexander Dalloz wrote: > > > > > Use a not expired certificate. > > > > > > $ openssl s_client -connect 194.163.45.150:993 > > > CONNECTED(00000003) > > > depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3 verify > > > error:num=10:certificate has expired notAfter=Sep 30 14:01:15 2021 GMT > > > > That error's happening because you (Alexander) are using an old openssl > version that has the problem described on: > > > > <https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/> > https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/ > > > > That's not the problem that the original poster is having unless Thunderbird > also has the same problem, which it may; see: > > > > > <https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049> > > https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049 > > > > > <https://www.arcanoae.com/adding-lets-encrypts-new-root-and-intermediate-certificates-to-mozilla-applications/> > > https://www.arcanoae.com/adding-lets-encrypts-new-root-and-intermediate-certificates-to-mozilla-applications/ > > > > In any case, this works fine with OpenSSL 1.1 or later: > > > > $ openssl s_client -connect mail.sizzelicks.com:993 > > ... > > * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE > > LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready. > > > > -- > > Robert L Mathews, Tiger Technologies, <http://www.tigertech.net/> > http://www.tigertech.net/ >
