Ubunto mail SSL certificate problem

Server conf: Server: Ubunto 14.04 server, ISP Config 3.04, postfix, Apache/2.4.7 (Ubuntu) Server

Task: I would like to make a secure connection via e-mail (SSL, TLS), and FTP for all my clients.

Description of the work and problems:

I installed (copied from old server) RapidSSL certificate, which works fine on websites.

I also configured certificates in main.ch for postfix.

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/smtpd.cert (symlink to ispserver.crt)
smtpd_tls_key_file = /etc/postfix/smtpd.key (symlink to ispserver.kay)
smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/IntermediateCA.crt (Rapid SSL CA; bundle)

Works fine with one big problem.

OS win X: At every new start of Outlook, users have to confirm every time that certificate is trusted (outlook reports that certificate is untrusted: »With Server. that you are connected, uses a security certificate, which cannot be verified. The main destination name is incorrect?« ) (Only for SSL port enabled), TLS works fine (why TLS works and SSL for pop3 doesn't)?

OS Android : works, but I have to choose: SSL (Accept all certificates). If I choose only SSL, it doesn't work.


IOS : works, but during the installation of email account I got for several times that the certificate is not verified … I confirmed for several times (2 or 3 times) and now appears that work at iPad.


Gmail: when I tried to import pop3 email account into Gmail account, Gmail returns this errors:

Secure SSL connection to the host mail.8000plus.si could not be established [Help]

The server returned an error: "SSL Error: Unable to verify the first certificate’


Then on: Free SSL Server Test I received next final grade (domain.si, grade):
(Domain:443 , C+)

(Domain:8080, B)

(Doamin:587, 993,995 (TLS,SSL), F)

Question?

Which command should I entered for SSLCipherSuite, and in particular in which file, because I use ISPconfig?

What else should I do to correct this certificates? I look over the forums and google it, but I couldn't find right answer.


Any help will be appreciate


Thank you and please understand that I am a newcomer to Linux

Tomislav Aurednik

 

I tend to think there's something wrong with the certs. Get thunderbird and check the cert info when it complains. Also yo could use letsencrypt certs. That's what I do nowadays

 

I also have some problem with TLS? Why my cert is untrusted?

 

Hi,
I did configure dovecot.
server install hostname: mail.8000plus.si (ISPConfig - > server services)
I change this name to 8000plus.si because I have certificate issued to this domain. (www.8000plus.si / 8000plus.si)
In main.cf myhostname is still mail.8000plus.si , If I change server name within ISPConfig - > server conf to 8000plus.si my emails doesn't work anymore. I'm pretty sure this has nothing to do with the certificates, but I do not know what else to do.

 

First of all, thank you very much for your help.
Should I use .pam or I can use .crt as I do now.
Ok. I put now CA roots too nto PF in DC: IntermediateCA.crt is my bundle CA cert
This works but I everytime in outlook I recieve that cert is untrasted and I have to confirmed? What I'm missing?
Or sould I combine all three certificates into pam (how to change the txt file in pam)?

dovecot
ssl = yes
ssl_cert = </usr/local/ispconfig/interface/ssl/ispserver.crt
ssl_key = </usr/local/ispconfig/interface/ssl/ispserver.key
ssl_ca = </usr/local/ispconfig/interface/ssl/IntermediateCA.crt
ssl_protocols = !SSLv2 !SSLv3
ssl_cipher_list = AES128+EECDH:AES128+EDH
ssl_prefer_server_ciphers = yes # >Dovecot 2.2.6
ssl_dh_parameters_length = 4096 # >Dovecot 2.2
...

postfix:
smtpd_use_tls=yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
#smtpd_tls_cert_file = /etc/postfix/smtpd.cert
#smtpd_tls_key_file = /etc/postfix/smtpd.key

smtpd_tls_cert_file=/usr/local/ispconfig/interface/ssl/ispserver.crt
smtpd_tls_key_file=/usr/local/ispconfig/interface/ssl/ispserver.key
smtpd_tls_CAfile =/usr/local/ispconfig/interface/ssl/IntermediateCA.crt

#smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/8000plus.si.bundle
#SSLCACertificateFile /usr/local/ispconfig/interface/ssl/8000plus.si.bundle

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_mandatory_ciphers = medium
tls_medium_cipherlist = AES128+EECDH:AES128+EDH
...

 

Hi,
It doesn't work
warning: TLS library problem: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:649:

I tried:
I have combined all three certifications in one, and it turned into a .pem file After using the command openssl x509 -in mycert.crt -out mycert.pem -outform PEM .It remained visible in the .txt file alone CA certificate. (I copied kay, Ca and web(root) cert).
I tried some other combinations too: k + Ca, w+Ca, ... Needer worked. I used crt and .pem format.

mail-server@mail:/etc/dovecot$ openssl s_client -host 8000plus.si -port 587 -starttls smtp -CApath /etc/ssl/certs/
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA
verify return:1
depth=0 CN = 8000plus.si
verify return:1
---
Certificate chain
0 s:/CN=8000plus.si
i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
1 s:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFajCCBFKgAwIBAgIQB4CS+dI9jRQMKLNGyQ6pzDANBgkqhkiG9w0BAQsFADBC
<snip>
fsBvPWiYbmDiuSLQnrRwMwqBKo4oze5/w7CrmUEeQboIdfgGTbu5F5syNS9Zjg==
-----END CERTIFICATE-----
subject=/CN=8000plus.si
issuer=/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
---
No client certificate CA names sent
---
SSL handshake has read 3224 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: BA2DA56C63B15DC82B5396DF0ADFDE7FF1F2B185BC3FFA26EFB7127E85238411
Session-ID-ctx:
Master-Key: F18B52CF81219F4EE0275097829E32ED955296552AD4939CDD36511E76D873A119A4DB6AF47B1EDFFC418B8FF57F411B
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1463443718
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
250 DSN

 

One more question:
Could you please write me the correct order for certificate. I have:
1. cert request file : ispserver.csr
2. server key (private domain cert) file : ispserver.key
3. server web (public domain cert) file: ispserver.crt
4. CA cert (intermediate, bundle cert from RapidSSL): IntermediateCA.crt

I don't know how to classify upper (my)) cert into The list below ? my certs are in brackets.

Chained SSL certificates
Put all the certificates in the ssl_cert file. For example when using a certificate signed by TDC the correct order is:

1. Dovecot's public certificate (ispserver.key)
   
2. TDC SSL Server CA (ispserver.crt)
3. TDC Internet Root CA (IntermediateCA.crt)
   
4. Globalsign Partners CA (ispserver.csr)

 

After I combine cer : key + public + ca + cert_req.csr I recieved this error:
error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:795:

 

I follow this: http://www.postfix.org/TLS_README.html#server_tls
After I combine cer (all .pem) : public + ca + rootCA
I don't understand why I get this: No client certificate CA names sent (in all ports)
What else I have to do, that certificates starts working ???
Any help will be appreciated

I get for 993 and 995 only this. Ther should be certificate , too? (I have it in dovecot.conf)
root@mail:/var/log# openssl s_client -host 8000plus.si -port 993 -starttls pop3 -CApath /etc/ssl/certs/
CONNECTED(00000003)
^C
root@mail:/var/log# openssl s_client -host 8000plus.si -port 995 -starttls pop3 -CApath /etc/ssl/certs/
CONNECTED(00000003)

port 110
root@mail:/var/log# openssl s_client -host 8000plus.si -port 110 -starttls pop3 -CApath /etc/ssl/certs/
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA
verify return:1
depth=0 CN = 8000plus.si
verify return:1
---
Certificate chain
0 s:/CN=8000plus.si
i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
1 s:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
2 s:/C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3
i:/C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFajCCBFKgAwIBAgIQB4CS+dI9jRQMKLNGyQ6pzDANBgkqhkiG9w0BAQsFADBC
...
fsBvPWiYbmDiuSLQnrRwMwqBKo4oze5/w7CrmUEeQboIdfgGTbu5F5syNS9Zjg==
-----END CERTIFICATE-----
subject=/CN=8000plus.si
issuer=/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
---
No client certificate CA names sent
---
SSL handshake has read 4279 bytes and written 459 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: 0A99B728163F426D98D54346019B99D6B601B4347AC25A248DC43DD41019569B
Session-ID-ctx:
Master-Key: 46461F9BE8719130DDA7FF732311CAA27B1DD6517F36785F190A2850405ECAE10B33DCF5AA1283DC46F3F373009775FD
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 27 94 5a bd 36 07 74 da-e5 20 37 f1 0b fc ab 1e '.Z.6.t.. 7.....
0010 - 10 5a 80 bd 5d 5d 8f 78-a3 4e 1e 86 e8 7d 0d ed .Z..]].x.N...}..
0020 - d9 03 df d1 2d f6 8e 1e-b4 78 12 70 32 88 b3 c2 ....-....x.p2...
0030 - 21 8f 50 34 8e 90 0d 2e-d9 9e d0 95 a7 a8 27 8e !.P4..........'.
0040 - 1a ab 29 31 92 a7 9c 33-91 76 04 8d 50 64 4d 02 ..)1...3.v..PdM.
0050 - 1c ed 13 ea eb c6 dd 88-a2 b7 a4 39 b3 d4 85 ab ...........9....
0060 - 4f e8 cc 36 c3 d4 a3 3c-76 8e 3c 1c ed 0d c6 45 O..6...<v.<....E
0070 - 4a 3c 06 17 84 49 7f fe-b4 d5 4d 3f 80 27 fa 7a J<...I....M?.'.z
0080 - 6d 8c f4 d6 08 f1 c0 52-f7 47 c5 23 0c d8 29 1c m......R.G.#..).
0090 - a6 b0 1e 91 1c e7 ff 08-f4 04 c3 94 94 97 91 cd ................

Start Time: 1464356065
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
+OK Dovecot (Ubuntu) ready.


port 587
root@mail:/etc/postfix# openssl s_client -host 8000plus.si -port 587 -starttls smtp -CApath /etc/ssl/certs/
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA
verify return:1
depth=0 CN = 8000plus.si
verify return:1
---
Certificate chain
0 s:/CN=8000plus.si
i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
1 s:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
2 s:/C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3
i:/C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFajCCBFKgAwIBAgIQB4CS+dI9jRQMKLNGyQ6pzDANBgkqhkiG9w0BAQsFADBC
...
fsBvPWiYbmDiuSLQnrRwMwqBKo4oze5/w7CrmUEeQboIdfgGTbu5F5syNS9Zjg==
-----END CERTIFICATE-----
subject=/CN=8000plus.si
issuer=/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA
---
No client certificate CA names sent
---
SSL handshake has read 4253 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 87D62C335C0BDD7A4D22675B382768D6D4DAF7DA37EA52CDFBFBDC03843AC767
Session-ID-ctx:
Master-Key: 1FCEFB0C7EBC859BF81BECC70DF4A81F417BC3BDDC2773060AF0FA6D5FAF1F0B68080E3D038C52FD050383F4171DF224
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1464351054
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
250 DSN