Hello I am having some issues with my mail server. Right now can only send mail via port 143 can't receive email. When setting up email program (gmail) get "Certificate not valid" Ceriticate not trusted. I am getting certificate error. Any help much appreciated Darren Checking mydomain.com from www12-do.checktls.com(V03.66.06) at 2022-09-08T01:34:54Z: seconds lookup result [000.000] DNS LOOKUPS [000.008] SEARCHLIST 104.131.108.216,134.209.169.224,1.1.1.1,8.8.8.8,67.207.67.3 [000.010] MX (10) mail.mydomain.com [000.012] MX:A-->mail.mydomain.com 11.111.11.111 seconds test stage and result [000.000] Trying TLS on mail.mydomain.com[11.111.11111:25] (10) [000.034] Server answered [000.110] <‑‑ 220 mail.mydomain.com ESMTP Postfix (Ubuntu) [000.111] We are allowed to connect [000.111] ‑‑> EHLO www12-do.checktls.com [000.145] <‑‑ 250-mail.mydomain.com 250-PIPELINING 250-SIZE 102400000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING [000.145] We can use this server [000.145] TLS is an option on this server [000.146] ‑‑> STARTTLS [000.179] <‑‑ 220 2.0.0 Ready to start TLS [000.180] STARTTLS command works on this server [000.233] Connection converted to SSL SSLVersion in use: TLSv1_3 Cipher in use: TLS_AES_256_GCM_SHA384 Perfect Forward Secrecy: yes Session Algorithm in use: Curve X25519 DHE(253 bits) Certificate #1 of 1 (sent by MX): Cert VALIDATION ERROR(S): unable to get local issuer certificate This may help: What Is An Intermediate Certificate So email is encrypted but the recipient domain is not verified Cert Hostname VERIFIED (mail.mydomain.com = mydomain.com | DNS:*.mydomain.com | DNS:mydomain.com) Not Valid Before: Jul 19 08:00:34 2022 GMT Not Valid After: Oct 17 08:00:33 2022 GMT subject: /CN=mydomain.com issuer: /C=US/O=Let's Encrypt/CN=R3 [000.238] > EHLO www12-do.checktls.com [000.302] < 250-mail.mydomain.com 250-PIPELINING 250-SIZE 102400000 250-VRFY 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING [000.302] TLS successfully started on this server [000.302] > MAIL FROM: test@checktls.com [000.346] < 250 2.1.0 Ok [000.346] Sender is OK [000.347] > QUIT [000.381] < 221 2.0.0 Bye

aaP_darren_kuzik Hi, where did you set it up and what program did you use to set it up?

Sorry someone else setup for me. Apparently didn't do good job. As far as i no it was through mailserver in aapanel. Fresh install. Maybe they never finished setting up

Or try to reapply for an SSL certificate?

just to make sure i am doing this right..., I go to website tab then mail website then ssl under let's encrypt do i renew or disable first then start again? Also under certificate holder tab what does deploy do

aaP_darren_kuzik Yes disable and reapply

Thanks but this doesn't help. I think renewing this did website mail.mydomain.com This is in the config tab on my mail website SSLCertificateFile /www/server/panel/vhost/cert/mail.mydomain.com/fullchain.pem SSLCertificateKeyFile /www/server/panel/vhost/cert/mail.mydomain.com/privkey.pem This is in 10-ssl.conf This maybe what i need to fix ssl_cert = < /www/server/panel/plugin/mail_sys/cert/mydomain.com/fullchain.pem ssl_key = < /www/server/panel/plugin/mail_sys/cert/mydomain.com/privkey.pem

aaP_darren_kuzik Website is SSL for website. Mail is SSL for mail. What is your environment like?

Sorry I am new to this don't really understand environment. My issue is to do with mail

SSL certificate issue

aaPanel_Kern

aaP_darren_kuzik
Does SSL remove reapplication?

Use this command to check what's wrong with SSL? Change to your domain name
openssl s_client -connect mail.domain:587 -starttls smtp

aaP_darren_kuzik

it changed expiry date.
here is what i get

CONNECTED(00000003)
depth=0 CN = mydomain.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = mydomain.com
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = mydomain.com

verify return:1

Certificate chain
0 s:CN = mydomain.com
i:C = US, O = Let's Encrypt, CN = R3
a😛KEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

v:NotBefore: Jul 19 08:00:34 2022 GMT; NotAfter: Oct 17 08:00:33 2022 GMT

Server certificate
-----BEGIN CERTIFICATE-----
MIIFOjCCBCKgAwIBAgISBC8jtH/blzwgeje90wwc6+zGMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA3MTkwODAwMzRaFw0yMjEwMTcwODAwMzNaMBsxGTAXBgNVBAMT
EHRodW5kZXJ0dnByby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQC8hL/ZRnH6oxWVRZ+4kcUaJhbxCi8HzyEFVtwuhyu1sQRDgqnhzEVy23BA27HE
/mqx1ReP9TKf/vczjxVUbdBM7CEHvJgRUQrz0YaBkY/Cw/xTvriKZX1WLx+euZK/
ID+PWIRMUySBW8kZmZXO3zdT3T+CwGWXVaIDNrMI4E4e+faA/w8odf7PwZm1Z6FK
ZbRwPRfifAspJkUsQr3Dl0aGDr5jPRnJ0MBnitzsUMm3jUNE/sQMz10EhyA81g96
Yu3IE5SP5VkHHoVVVI+9ffF/qWS/L4jWJRD/ZmryAXrVTYUgO/Yqx1YUqHzaRMv1
oOR9zAqCeDfhEpXd6gnROTWFAgMBAAGjggJfMIICWzAOBgNVHQ8BAf8EBAMCBaAw
HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD
VR0OBBYEFHOTOG0XJHvrlFbCKEnNtZ/eY/yiMB8GA1UdIwQYMBaAFBQusxe3WFbL
rlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDov
L3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5jci5v
cmcvMC8GA1UdEQQoMCaCEioudGh1bmRlcnR2cHJvLmNvbYIQdGh1bmRlcnR2cHJv
LmNvbTBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsG
AQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQQGCisGAQQB1nkC
BAIEgfUEgfIA8AB2AEalVet1+pEgMLWiiWn0830RLEF0vv1JuIWr8vxw/m1HAAAB
ghWwCRMAAAQDAEcwRQIgIX45Amk+/5+57VlrzNxwOgygNkeJiSI5JbjmDJ4SiEwC
IQCu80wIjdGRWgpf3w1F71Pze6vg/ORK+Gc3Yb7S7xUIdgB2AG9Tdqwx8DEZ2JkA
pFEV/3cVHBHZAsEAKQaNsgiaN9kTAAABghWwCfgAAAQDAEcwRQIgG55nsc0SffeI
B/1PXgC47LOfTEDtwNdU+72poPdRhW8CIQCTPh6rXxt96b1AarV5hk5sYpFdUbHb
duwoOW/2CZ7KNDANBgkqhkiG9w0BAQsFAAOCAQEAKo2bj1eae7boOZTHb1RogFTd
DOxAY2gYVnr+3jq/uU46KNx8n8Y8sxvtyqMp5y4yJw8H/AhSUrsxRiqbgpOgxHrH
oBnlaa6scFCTaFysU5mWfQZboUYIDYLBQYaYlMdVQj14wF6VTJ6OKZIg8Uadp4qT
RrnX/09iI8i9imQBis19OpqdFn5tS5YSXi6n1217UeBK0AAoaLmshzVdC7Filj4W
ox7bGNoURiGmt3VpOFEYKij5N7apqOVSNWVOGF+k0T5N6SdqkoorJnE6rn9kIPWi
TvQBRqNNYuN2HoFwyG86OeYWJEt/WuGVYq241FADizx3OOaEQ4A6jhhM2vk6vA==
-----END CERTIFICATE-----
subject=CN = mydomain.com

issuer=C = US, O = Let's Encrypt, CN = R3

No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS

Server Temp Key: X25519, 253 bits

SSL handshake has read 2155 bytes and written 436 bytes

Verification error: unable to verify the first certificate

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent

Verify return code: 21 (unable to verify the first certificate)

250 CHUNKING

Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: D2B88B2EFD1126952E222E9CD4FD439512D820ADD687D091DD51440D7152C6BF
Session-ID-ctx:
Resumption PSK: 0079DA0FE0497D1245CEDB86AF492928F23A56100AF66C563DBE263379369606FD9D93AD2E590A887786BA6C51934F14
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 05 c3 70 52 a1 97 af 18-17 71 99 19 02 ed 2e 72 ..pR.....q.....r
0010 - 3e 84 2a 96 fd a4 77 61-28 9f f6 1e 65 df 89 3c >....wa(...e..<
0020 - 2c fd 12 8f ff 8b 37 a0-96 f5 80 ea 4b df 0b 94 ,.....7.....K...
0030 - 4a 3d 99 ad 8d 42 96 72-ed ac 91 13 91 04 7a cb J=...B.r......z.
0040 - 0e 89 0a 0a f3 d3 30 72-fd 59 81 7d 0b 27 d6 2e ......0r.Y.}.'..
0050 - 49 3d cb 58 9b 20 ef b2-b5 c3 26 c9 fc 7e 9d a5 I=.X. ....&..~..
0060 - 4c 72 42 4b 1d cd 13 31-e7 9a 61 8f ec 7d 1a f4 LrBK...1..a..}..
0070 - 70 b2 95 3b 9f a5 c1 51-fc c3 be c0 3f 90 97 ab p..;...Q....?...
0080 - 0d 7e 20 93 af 1d 2e 45-94 af b8 db 86 c0 91 8d .~ ....E........
0090 - 86 af 42 37 66 05 0f 47-70 b1 63 ea c8 4a df 3b ..B7f..Gp.c..J.;
00a0 - fa 7f ee 14 7d 5e 5a 99-e9 f9 c0 46 7a 6e 9b c6 ....}^Z....Fzn..
00b0 - 95 27 b0 2a 13 e2 18 91-48 00 ac 52 e3 2d 1f bf .'.....H..R.-..
00c0 - 80 72 89 d1 4d 7d b6 69-89 29 d6 fe 42 1e 08 8f .r..M}.i.)..B...
00d0 - 80 dd 59 45 ae 34 ef f0-b7 3a 7c d3 9f 77 5d 35 ..YE.4...😐..w]5
00e0 - 19 ab f4 f5 a2 7e 21 86-bc 86 47 2b 9f cc 2d 75 .....~!...G+..-u

Start Time: 1662689906
Timeout   : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0

read R BLOCK

aaPanel_Kern

aaP_darren_kuzik
Hello, try to modify the configuration in the Config of postfix in the Service Status interface of the mail server management interface
Put: smtpd_tls_chain_files=/etc/ssl/private/ssl-cert-snakeoil.key,/etc/ssl/certs/ssl-cert-snakeoil.pem
Change to: smtpd_tls_chain_files = /www/server/panel/plugin/mail_sys/cert/135mailtest.com/privkey.pem,/www/server/panel/plugin/mail_sys/cert/135mailtest.com/fullchain.pem
Note to replace 135mailtest.com with your domain name.
Also check /www/server/panel/plugin/mail_sys/cert/135mailtest.com/ for privkey.pem and fullchain.pem files

aaP_darren_kuzik

Unfortunatly that didn't help.

aaPanel_Kern

aaP_darren_kuzik
Did you restart postfix after the replacement? try restarting postfix

aaP_darren_kuzik

yes restart postfix and dovecot

aaPanel_Kern

aaP_darren_kuzik
Hi, can you give us your aapanel information? The server makes a snapshot backup first, if possible, please send it to kern@aapanel.com.
It is recommended to fill in the following
Post link:
SSH IP address, account password and port:
aapanel login link address and account password:

aaP_darren_kuzik

I did get this ssl err which i haven't seen before. get same error with original config

Sep 8 21:06:26 mail postfix/master[701817]: terminating on signal 15
Sep 8 21:06:30 mail postfix/postfix-script[703521]: warning: /var/spool/postfix/etc/localtime and /etc/localtime differ
Sep 8 21:06:30 mail postfix/postfix-script[703605]: warning: /var/spool/postfix/etc/ssl/certs/ssl-cert-snakeoil.pem and /etc/ssl/certs/ssl-cert-snakeoil.pem differ
Sep 8 21:06:31 mail postfix/postfix-script[703658]: warning: /var/spool/postfix/lib/x86_64-linux-gnu/libnss_compat.so.2 and /lib/x86_64-linux-gnu/libnss_compat.so.2 differ
Sep 8 21:06:31 mail postfix/postfix-script[703660]: warning: /var/spool/postfix/lib/x86_64-linux-gnu/libresolv.so.2 and /lib/x86_64-linux-gnu/libresolv.so.2 differ
Sep 8 21:06:31 mail postfix/postfix-script[703665]: warning: /var/spool/postfix/lib/x86_64-linux-gnu/libnss_hesiod.so.2 and /lib/x86_64-linux-gnu/libnss_hesiod.so.2 differ
Sep 8 21:06:31 mail postfix/postfix-script[703668]: warning: /var/spool/postfix/lib/x86_64-linux-gnu/libnss_dns.so.2 and /lib/x86_64-linux-gnu/libnss_dns.so.2 differ
Sep 8 21:06:31 mail postfix/postfix-script[703670]: warning: /var/spool/postfix/lib/x86_64-linux-gnu/libnss_files.so.2 and /lib/x86_64-linux-gnu/libnss_files.so.2 differ
Sep 8 21:06:31 mail postfix/postfix-script[703676]: starting the Postfix mail system
Sep 8 21:06:31 mail postfix/master[703678]: daemon started -- version 3.6.4, configuration /etc/postfix

aaPanel_Kern

Copy the postfix configuration

aaP_darren_kuzik

See /usr/share/postfix/main.cf.dist for a commented, more complete version

Debian specific: Specifying a file name will cause the first

line of that file to be used as the name. The Debian default

is /etc/mailname.

#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

appending .domain is the MUA's job.

append_dot_mydomain = no

Uncomment the next line to generate "delayed mail" warnings

#delay_warning_time = 4h

readme_directory = no

See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on

fresh installs.

compatibility_level = 3.6

TLS parameters

#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level = may

smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.mydomain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination =
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_mailbox_domains = sqlite:/etc/postfix/sqlite_virtual_domains_maps.cf
virtual_alias_maps= sqlite:/etc/postfix/btrule.cf
virtual_mailbox_maps = sqlite:/etc/postfix/sqlite_virtual_mailbox_maps.cf, sqlite:/etc/postfix/sqlite_virtual_alias_domain_mailbox_maps.cf
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_use_tls = yes
virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_protocol = 6
milter_default_action = accept
message_size_limit = 102400000

smtpd_tls_chain_files = /www/server/panel//plugin/mail_sys/cert/mydomain.com/privkey.pem,/www/server/panel/plugin/mail_sys/cert/mydomain.com/fullchain.pem

#smtpd_tls_chain_files = /etc/ssl/private/ssl-cert-snakeoil.key,/etc/ssl/certs/ssl-cert-snakeoil.pem
tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map

aaPanel_Kern

aaP_darren_kuzik
The configuration is normal.

aaP_darren_kuzik

ok. but still have certificate issue

aaPanel_Kern

aaP_darren_kuzik
Hi, try again. I removed SSL and reapplied.

openssl s_client -connect mail.xxx.com:587 -starttls smtp

aaP_darren_kuzik

what did you do differently from disable ssl and re-enable?

You are a life saver

aaPanel_Kern

aaP_darren_kuzik
Deletion is to delete the old SSL and then re-apply for the SSL, and there will be a new SSL. Disable is to disable SSL, and then turn it on again, the SSL certificate is still the same old
If there is no problem, please change the ssh password and aapanel password

aaP_darren_kuzik

thanks
One more issue, i can send mail but not receive

aaPanel_Kern

aaP_darren_kuzik
Forwarding problem. Normal after closing.

aaP_darren_kuzik

For some reason I lost my mail server.
I had to repair it got it back but have ssl issue.
I don't have that delete key. like you show
i can disable then
I can only find delete under certificate holder.
and redo file validation
but getting same issue
have to wait 1 hour tried to many times to reissue
be back tommorow

aaPanel_Kern

The mail server has only DNS verification.
The SSL of the email and the SSL of the website are not the same, but two different SSLs

aaP_darren_kuzik

Sorry have another problem.
SSL is fine.
outgoing mail is fine.
can't receive incoming mail.
get "email security not guaranteed. There was a problem setting up security for this account"
using gmail app

aaPanel_Kern

aaP_darren_kuzik
Check the log, check for the problem, and fix it.
Is it possible to use other clients besides gmail to receive it?

« Previous Page