<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jul 22, 2018, at 9:04 AM, Voytek Eymont <<a href="mailto:voytek@sbt.net.au" class="">voytek@sbt.net.au</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">I've installed LE certs on my Dovecot a while back, and, it has been<br class="">working OK since, but, today, an iPhone user said he can't get emails as<br class="">iphone says 'cert is expired', <br class="">(if I open mailserver host in browser, padlock shows current/valid cert)<br class=""><br class=""></div></div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">Usually, a browser connects to a web server on port 443, while an email client connects to an IMAP or POP server on a different port, served by different software. Just because your browser receives a current/valid cert, that doesn’t mean your dovecot server is sending the same certificate.</div><div class=""><br class=""></div><div class="">Assuming the <a href="http://sbt.net.au" class="">sbt.net.au</a> in your email address is the address of your dovecot server, I tried</div><div class=""><br class=""></div><div class="">openssl s_client -connect <a href="http://sbt.net.au:143" class="">sbt.net.au:143</a> -starttls imap</div><div class=""><br class=""></div><div class="">And received a cert which includes:</div><div class=""><br class=""></div><div class=""><div class="">Certificate:</div><div class=""> Data:</div><div class=""> Version: 3 (0x2)</div><div class=""> Serial Number:</div><div class=""> 03:5b:41:a6:f4:a6:33:eb:5b:ac:af:b8:20:96:f4:0e:20:b9</div><div class=""> Signature Algorithm: sha256WithRSAEncryption</div><div class=""> Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3</div><div class=""> Validity</div><div class=""> Not Before: Apr 23 11:11:28 2018 GMT</div><div class=""> Not After : Jul 22 11:11:28 2018 GMT</div><div class=""> Subject: CN=<a href="http://geko.sbt.net.au" class="">geko.sbt.net.au</a></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Dovecot is sending an expired cert. Pascai is correct; you need to restart it.</div></body></html>