Looks fine from my side, both on pop3s

ychaouche#ychaouche-PC 13:58:25 ~ $ openssl s_client -connect 103.106.168.105:995 -CApath /etc/ssl/certs
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = emu.sbt.net.au
verify return:1
---
Certificate chain
0 s:/CN=emu.sbt.net.au
   i:/C=US/O=Let's Encrypt/CN=R3
1 s:/C=US/O=Let's Encrypt/CN=R3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=/CN=emu.sbt.net.au
issuer=/C=US/O=Let's Encrypt/CN=R3
---
[...]
    Start Time: 1614694135
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
+OK Dovecot ready.
^C
ychaouche#ychaouche-PC 15:09:01 ~ $

and on pop3 with starttls

ychaouche#ychaouche-PC 15:14:28 ~ $ openssl s_client -starttls pop3 -connect 103.106.168.105:pop3 -CApath /etc/ssl/certs
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = emu.sbt.net.au
verify return:1
---
Certificate chain
0 s:/CN=emu.sbt.net.au
   i:/C=US/O=Let's Encrypt/CN=R3
1 s:/C=US/O=Let's Encrypt/CN=R3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=/CN=emu.sbt.net.au
issuer=/C=US/O=Let's Encrypt/CN=R3
---
[...]
    Start Time: 1614694499
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
+OK Dovecot ready.
^C
ychaouche#ychaouche-PC 15:15:04 ~ $

Le 3/2/21 à 1:41 PM, Erwan David a écrit :

Le 02/03/2021 à 13:29, Voytek Eymont a écrit :

since a couple of days one of users reported getting expired certificate
error in TB, looking at the log, I can see like:

Mar 02 21:46:24 pop3-login: Info: Disconnected (no auth attempts in 0
secs): user=<>, rip=111.222.333.444, lip=103.106.168.105, TLS: SSL_read
failed: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert
certificate expired: SSL alert number 45, session=<...>


Here it is the certificate presented on the pop3 port (either port 110
with a STLS command or port 995)

but, looking at server with
https://ssl-tools.net/mailservers/emu.sbt.net.au it says 'valid' as does
certbot tool


Here it seems te site tests the smtp server (on port 25), which is not
handled by dovecot. You probably have different certificates on both.