Dovecot serving incorrect certificate
Hello all,
I have a Dovecot (v2.3.10.1) + Postfix (v3.5.3) both cfg; d to use TLS however each using different certificates. In addition, I have cfg’d a DNS CNAME that points to the server A record. For example,
mail.example.com (A) —> 1.2.3.4 alias.example.con (CNAME) —> mail.example.com
When setting up a new account in Apple Mail, if I specify the server name as the “Host Name” (i.e. mil server), the cert that is cfg’d in Dovecot is received and everything works fine. However, if I instead use the alias CNAME as the “Host Name”, then the cert for Postfix is sent to the client. This causes issues because I do not have the CNAME in the SAN of the Postfix certificate.
I doubt this is a bug because I have to think others have employed a similar configuration so I must be missing something here — any thoughts?
Thanks in advance...
CORRECTION:
Just discovered that actually the Postfix cert is being sent to the client regardless of the configuration…so now the remaining question is why would is the PF cert sent rather than the cert I have configured in the dovecot.conf file?
On Jul 25, 2020, at 2:02 PM, Antonio Leding tech@leding.net wrote:
Hello all,
I have a Dovecot (v2.3.10.1) + Postfix (v3.5.3) both cfg; d to use TLS however each using different certificates. In addition, I have cfg’d a DNS CNAME that points to the server A record. For example,
mail.example.com http://mail.example.com/ (A) —> 1.2.3.4 alias.example.con (CNAME) —> mail.example.com http://mail.example.com/
When setting up a new account in Apple Mail, if I specify the server name as the “Host Name” (i.e. mil server), the cert that is cfg’d in Dovecot is received and everything works fine. However, if I instead use the alias CNAME as the “Host Name”, then the cert for Postfix is sent to the client. This causes issues because I do not have the CNAME in the SAN of the Postfix certificate.
I doubt this is a bug because I have to think others have employed a similar configuration so I must be missing something here — any thoughts?
Thanks in advance...
On 2020-07-25 23:31, Antonio Leding wrote:
CORRECTION:
Just discovered that actually the Postfix cert is being sent to the client regardless of the configuration…so now the remaining question is why would is the PF cert sent rather than the cert I have configured in the dovecot.conf file? Because the file containes the wrong certificate.
-- Christian Kivalo
Because the file containes the wrong certificate.
We must be miscommunicating…
The file that is configured in Postfix is being sent to the client..NOT the file cfg’d in Dovecot…
Prior to enabling TLS in Postfix, this exact same config worked fine...
On Jul 25, 2020, at 2:35 PM, Christian Kivalo ml+dovecot@valo.at wrote:
On 2020-07-25 23:31, Antonio Leding wrote:
CORRECTION: Just discovered that actually the Postfix cert is being sent to the client regardless of the configuration…so now the remaining question is why would is the PF cert sent rather than the cert I have configured in the dovecot.conf file? Because the file containes the wrong certificate.
-- Christian Kivalo
Issued resolved...
Someone had actually copied the cert from the PF server to the DV cert location as well but renamed it to the same name that we had before. So when looking at the config, everything appeared proper but after Christian’s message, I decided to go and actually check the cert contents…it had been changed…
Thanks to Christian and darkc0de and sorry for the false alarm...and now need to go have a discussion with someone…
On Jul 25, 2020, at 2:43 PM, Antonio Leding tech@leding.net wrote:
Because the file containes the wrong certificate.
We must be miscommunicating…
The file that is configured in Postfix is being sent to the client..NOT the file cfg’d in Dovecot…
Prior to enabling TLS in Postfix, this exact same config worked fine...
On Jul 25, 2020, at 2:35 PM, Christian Kivalo ml+dovecot@valo.at wrote:
On 2020-07-25 23:31, Antonio Leding wrote:
CORRECTION: Just discovered that actually the Postfix cert is being sent to the client regardless of the configuration…so now the remaining question is why would is the PF cert sent rather than the cert I have configured in the dovecot.conf file? Because the file containes the wrong certificate.
-- Christian Kivalo
participants (2)
-
Antonio Leding
-
Christian Kivalo