Hello I am having some issues with my mail server. Right now can only send mail via port 143 can't receive email. When setting up email program (gmail) get "Certificate not valid" Ceriticate not trusted. I am getting certificate error. Any help much appreciated Darren Checking mydomain.com from www12-do.checktls.com(V03.66.06) at 2022-09-08T01:34:54Z: seconds lookup result [000.000] DNS LOOKUPS [000.008] SEARCHLIST 104.131.108.216,134.209.169.224,1.1.1.1,8.8.8.8,67.207.67.3 [000.010] MX (10) mail.mydomain.com [000.012] MX:A-->mail.mydomain.com 11.111.11.111 seconds test stage and result [000.000] Trying TLS on mail.mydomain.com[11.111.11111:25] (10) [000.034] Server answered [000.110] <‑‑ 220 mail.mydomain.com ESMTP Postfix (Ubuntu) [000.111] We are allowed to connect [000.111] ‑‑> EHLO www12-do.checktls.com [000.145] <‑‑ 250-mail.mydomain.com 250-PIPELINING 250-SIZE 102400000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING [000.145] We can use this server [000.145] TLS is an option on this server [000.146] ‑‑> STARTTLS [000.179] <‑‑ 220 2.0.0 Ready to start TLS [000.180] STARTTLS command works on this server [000.233] Connection converted to SSL SSLVersion in use: TLSv1_3 Cipher in use: TLS_AES_256_GCM_SHA384 Perfect Forward Secrecy: yes Session Algorithm in use: Curve X25519 DHE(253 bits) Certificate #1 of 1 (sent by MX): Cert VALIDATION ERROR(S): unable to get local issuer certificate This may help: What Is An Intermediate Certificate So email is encrypted but the recipient domain is not verified Cert Hostname VERIFIED (mail.mydomain.com = mydomain.com | DNS:*.mydomain.com | DNS:mydomain.com) Not Valid Before: Jul 19 08:00:34 2022 GMT Not Valid After: Oct 17 08:00:33 2022 GMT subject: /CN=mydomain.com issuer: /C=US/O=Let's Encrypt/CN=R3 [000.238] > EHLO www12-do.checktls.com [000.302] < 250-mail.mydomain.com 250-PIPELINING 250-SIZE 102400000 250-VRFY 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING [000.302] TLS successfully started on this server [000.302] > MAIL FROM: test@checktls.com [000.346] < 250 2.1.0 Ok [000.346] Sender is OK [000.347] > QUIT [000.381] < 221 2.0.0 Bye

aaP_darren_kuzik Hi, where did you set it up and what program did you use to set it up?

Sorry someone else setup for me. Apparently didn't do good job. As far as i no it was through mailserver in aapanel. Fresh install. Maybe they never finished setting up

Or try to reapply for an SSL certificate?

just to make sure i am doing this right..., I go to website tab then mail website then ssl under let's encrypt do i renew or disable first then start again? Also under certificate holder tab what does deploy do

aaP_darren_kuzik Yes disable and reapply

Thanks but this doesn't help. I think renewing this did website mail.mydomain.com This is in the config tab on my mail website SSLCertificateFile /www/server/panel/vhost/cert/mail.mydomain.com/fullchain.pem SSLCertificateKeyFile /www/server/panel/vhost/cert/mail.mydomain.com/privkey.pem This is in 10-ssl.conf This maybe what i need to fix ssl_cert = < /www/server/panel/plugin/mail_sys/cert/mydomain.com/fullchain.pem ssl_key = < /www/server/panel/plugin/mail_sys/cert/mydomain.com/privkey.pem

aaP_darren_kuzik Website is SSL for website. Mail is SSL for mail. What is your environment like?

Sorry I am new to this don't really understand environment. My issue is to do with mail

aaP_darren_kuzik Does SSL remove reapplication? Use this command to check what's wrong with SSL? Change to your domain name openssl s_client -connect mail.domain:587 -starttls smtp

SSL certificate issue

aaP_darren_kuzik

ok. but still have certificate issue

aaPanel_Kern

aaP_darren_kuzik
Hi, try again. I removed SSL and reapplied.

openssl s_client -connect mail.xxx.com:587 -starttls smtp

aaP_darren_kuzik

what did you do differently from disable ssl and re-enable?

You are a life saver

aaPanel_Kern

aaP_darren_kuzik
Deletion is to delete the old SSL and then re-apply for the SSL, and there will be a new SSL. Disable is to disable SSL, and then turn it on again, the SSL certificate is still the same old
If there is no problem, please change the ssh password and aapanel password

aaP_darren_kuzik

thanks
One more issue, i can send mail but not receive

aaPanel_Kern

aaP_darren_kuzik
Forwarding problem. Normal after closing.

aaP_darren_kuzik

For some reason I lost my mail server.
I had to repair it got it back but have ssl issue.
I don't have that delete key. like you show
i can disable then
I can only find delete under certificate holder.
and redo file validation
but getting same issue
have to wait 1 hour tried to many times to reissue
be back tommorow

aaPanel_Kern

The mail server has only DNS verification.
The SSL of the email and the SSL of the website are not the same, but two different SSLs

aaP_darren_kuzik

Sorry have another problem.
SSL is fine.
outgoing mail is fine.
can't receive incoming mail.
get "email security not guaranteed. There was a problem setting up security for this account"
using gmail app

aaPanel_Kern

aaP_darren_kuzik
Check the log, check for the problem, and fix it.
Is it possible to use other clients besides gmail to receive it?

aaP_darren_kuzik

I am sorry I now we have already gone through this but still having problems.
I delete my mail server ssl.
Added new ssl dns verification through cloudflare. Api-limit is on (not sure what this is)
have tried multiple times
Not sure what to do, I have googled it but no help. Everything above has been done
This is from error log
mail dovecot: pop3-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): The certificate is empty: user=<>, rip=222.222.222.2222, lip=11.111.11.111, session=<1nSz/57piImijn3c>

here is error when i run command below
openssl s_client -connect mail.mydomain.com:587 -starttls smtp

CONNECTED(00000003)
depth=0 CN = mydomain.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = mydomain.com
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = mydomain.com
verify return:1

aaPanel_Kern

aaP_darren_kuzik
Hello, please replace the SSL again. Do not use the cloudflare API to automatically verify and try to manually add txt records

aaP_darren_kuzik

so I deleted ssl. Did manual resolution. It issued certification but no popup for txt records.
I tried again same way except cloudflare paused.
I am getting no popups giving me txt records to add.
getting same error missing first certificate

maybe i will try again after 24 hours.

« Previous Page