no imap-login possible, SSL-issue / SOLVED

Hi!

Since this morning, no imap-login is possible. It seems that tonight a letsencrypt-renew was done. Thunderbird is not able to login the accounts - it stalls and nothing is happen.

We have a maindomain linke "main.at" and a subdomain like "customermail.main.at" (https://www.howtoforge.com/securing...server-with-a-valid-lets-encrypt-certificate/), customermail worked flawlessly for month.

In Syslog are the following lines

Code:

Dec 14 06:12:21 tesoro2 systemd[1]: Starting Postfix Mail Transport Agent (instance -)...
Dec 14 06:12:22 tesoro2 postfix/postfix-script[43232]: warning: symlink leaves directory: /etc/postfix/./smtpd.cert-20221214051002.bak
Dec 14 06:12:22 tesoro2 postfix/postfix-script[43235]: warning: symlink leaves directory: /etc/postfix/./smtpd.key-220618213526.bak
Dec 14 06:12:22 tesoro2 postfix/postfix-script[43238]: warning: symlink leaves directory: /etc/postfix/./smtpd.cert
Dec 14 06:12:22 tesoro2 postfix/postfix-script[43241]: warning: symlink leaves directory: /etc/postfix/./smtpd.key-20221214051002.bak
Dec 14 06:12:22 tesoro2 postfix/postfix-script[43244]: warning: symlink leaves directory: /etc/postfix/./smtpd.cert-220618213522.bak
Dec 14 06:12:22 tesoro2 postfix/postfix-script[43247]: warning: symlink leaves directory: /etc/postfix/./smtpd.key

Dec 14 06:12:46 tesoro2 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=80.75.246.35, lip=136.243.47.106, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<YMZ/ycLvluJQS/Yj>
Dec 14 06:12:46 tesoro2 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=80.75.246.35, lip=136.243.47.106, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<ket/ycLvleJQS/Yj>
Dec 14 06:12:46 tesoro2 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=80.75.246.35, lip=136.243.47.106, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<lfB/ycLvl+JQS/Yj>

Dec 14 06:14:30 tesoro2 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=2a02:8388:a080:c100:a8f3:7893:c741:646b, lip=2a01:4f8:212:f65::2, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<r+1flMPvs+sqAoOIoIDBAKjzeJPHQWRr>

and maybe a helpful excerpt of doing a connection on the comanndline

Code:

#openssl s_client -starttls smtp -showcerts -connect customermail.main.at:25
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = tesoro2.main.at
verify return:1
---
Certificate chain
 0 s:CN = tesoro2.main.at
   i:C = US, O = Let's Encrypt, CN = R3
-----BEGIN CERTIFICATE-----
MIIFNTCCBB2gAwIBAgISA7r7Ntvr6fLeFnv0+6HpiXiWMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjEyMTMyMjM3NTZaFw0yMzAzMTMyMjM3NTVaMCMxITAfBgNVBAMT
GHRlc29ybzIucHJvZHVjdHM0bW9yZS5hdDCCASIwDQYJKoZIhvcNAQEBBQADggEP
-+--SNIP-+--
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
---
Server certificate
subject=CN = tesoro2.main.at

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4886 bytes and written 434 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
250 CHUNKING
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: CA9B54BA472867B8A23D7671EF84D68DAA22B87B1B9BA91C0107C6C389923A05
    Session-ID-ctx:
    Resumption PSK: 948CEEDF26271B177BB47359D1566F9DE5258930CA27EAD9306E7E36647046637B91E60B66F9003D540A33C158630787
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 04 ce ef 71 6b f4 19 38-18 a8 a4 ef e9 0d 9f 8f   ...qk..8........
    0010 - 0a 8c 6e 25 fc be f0 6c-32 8d c3 60 3b 68 72 33   ..n%...l2..`;hr3
    0020 - 40 09 9e 66 c4 1f ee fc-15 e2 eb 46 54 1b e5 48   @..f.......FT..H
    0030 - 7a e2 df c8 1e 84 af 41-17 fc f2 f2 34 b3 c8 49   z......A....4..I
    0040 - a3 d6 fd c1 cc b0 c3 61-40 ca 79 04 ca b7 36 8f   [email protected].
    0050 - b2 c9 d3 70 8e 8c c0 f3-51 48 b5 5b 58 0b 96 08   ...p....QH.[X...
    0060 - 85 2f e1 75 06 c8 27 47-27 f6 f3 ba 62 c9 5d 2b   ./.u..'G'...b.]+
    0070 - 89 ee a6 fb 2f df ab bf-c2 4c 9b 77 80 a0 7f da   ..../....L.w....
    0080 - ce 5c 5e 18 8f 6c be 09-43 88 59 b1 3d 6f 67 55   .\^..l..C.Y.=ogU
    0090 - ff f6 bd d7 96 13 af 89-7e b7 62 99 be c4 8e 99   ........~.b.....
    00a0 - 36 e6 ba 27 07 95 6f 0b-f5 e4 78 2b 78 30 ad 45   6..'..o...x+x0.E
    00b0 - bb 65 ca 87 4e e0 12 17-2f a4 02 cf 23 9b bd 97   .e..N.../...#...
    00c0 - 38 10 4f 37 4a f7 fb 35-f9 5c a6 86 12 53 7f 19   8.O7J..5.\...S..

    Start Time: 1670996697
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

In this connection, there is nothing about customermail.main.at - is this ok?

What I have done:
ispconfig_update.sh --force and reconfiguring the services + recreate is-confit-ssl-certificates.
Renewed the certificate for our domain, checked the domain on slabs.com "main" and "customermail" got a green check. Even checked on sslshopper.com/ssl-checker.html - all green.

Using checktls.com says:

Code:

Connection converted to SSL
SSLVersion in use: TLSv1_3
Cipher in use: TLS_AES_256_GCM_SHA384
Perfect Forward Secrecy: yes
Session Algorithm in use: Curve X25519 DHE(253 bits)
Certificate #1 of 4 (sent by MX):
Cert VALIDATED: ok
Cert Hostname DOES NOT VERIFY (customermail.main.at != tesoro2.main.at | DNS:tesoro2.main.at)
So email is encrypted but the host is not verified
Not Valid Before: Dec 13 22:37:56 2022 GMT
Not Valid After: Mar 13 22:37:55 2023 GMT
subject: /CN=tesoro2.main.at
issuer: /C=US/O=Let's Encrypt/CN=R3

Any ideas what happened and the most important thing: any hints how I fix that?

Thank you!

 

Hmmmm .... Found this hint, but we have the problem not only on Apple devices. We can't retrieve 2210 on Ubuntu either.
https://www.hagenfragen.de/linux-ti...er-46-mit-letsencrypt-unter-ubuntu-20-04.html
How could the hint be implemented? There is no link to a fullchain in /etc/postfix.

 

Yes - there is a (temporary?) solution:

the symbolic links in /etc/postfix where linked to
mtpd.cert -> /usr/local/ispconfig/interface/ssl/ispserver.crt
smtpd.key -> /usr/local/ispconfig/interface/ssl/ispserver.key

instead of

smtpd.key -> /root/.acme.sh/main.at/main.at.key
smtpd.cert -> /root/.acme.sh/main.at/fullchain.cer

I will monitor these in the next weeks, if they are moving again.

 

Check this Thread: https://forum.howtoforge.com/threads/ispconfig-certificate-is-expired.89715/#post-440520