<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Random addition to this thread, in case it helps ... recently had
a client reporting certificate problems after Letsencrypt changed
their root certificate late last year. Long story short: it boiled
down to the fact he was using an ancient version of Outlook which
didn't have the necessary root certificates to verify the new
Letsencrypt cross-signed root cert. More recent versions of
Outlook were fine. So maybe that's another line of inquiry? <br>
</p>
<p>P.<br>
</p>
<div class="moz-cite-prefix">On 09/02/2022 09.56, justina colmena
~biz wrote:<br>
</div>
<blockquote type="cite"
cite="mid:B8767530-B817-4BF6-AC55-F26C57A2DD44@colmena.biz">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->You shouldn't need a root in the full
chain, because the client already has to have the root cert, but
you do need all the links in the chain up to the root.<br>
<br>
<div class="gmail_quote">On February 8, 2022 4:13:06 PM AKST,
Wayne Spivak <a class="moz-txt-link-rfc2396E" href="mailto:WSpivak@SBANetWeb.com"><WSpivak@SBANetWeb.com></a> wrote:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt
0.8ex; border-left: 1px solid rgb(204, 204, 204);
padding-left: 1ex;">
<div class="WordSection1">
<p class="MsoNormal">Justina,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The vendor I have, which is having the
difficulty is still saying he gets a self-signed cert… but
as I showed in my last email after I added Intermediate to
the certificate, everything was ok.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So ServerCert, Intermediate, Root in
same file should solve this?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Wayne<o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> dovecot
<a class="moz-txt-link-rfc2396E" href="mailto:dovecot-bounces@dovecot.org"><dovecot-bounces@dovecot.org></a> <b>On Behalf Of </b>justina
colmena ~biz<br>
<b>Sent:</b> Tuesday, February 8, 2022 2:44 PM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a><br>
<b>Subject:</b> Re: Certificate and showing a
sign-cert not there<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">In
general:<br>
<br>
Lots of mail servers out in the wild do not require TLS or
even bother to verifying TLS certificates when connecting
to a remote server on port 25.<br>
<br>
However, desktop and mobile email *clients* tend to be
much stricter about verifying server certificates when
connecting via SSL or TLS, mainly to protect user
passwords.<br>
<br>
Sometimes the server certificate needs to be presented
with a "full chain" appended to it for verification. That
has been an issue before when I've used some certs,
particularly StartSSL before Letsencrypt started offering
free certs.<o:p></o:p></p>
<div>
<p class="MsoNormal">On February 8, 2022 5:53:34 AM AKST,
Wayne Spivak <<a href="mailto:WSpivak@SBANetWeb.com"
moz-do-not-send="true" class="moz-txt-link-freetext">WSpivak@SBANetWeb.com</a>>
wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC
1.0pt;padding:0in 0in 0in
6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Hi –<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am running Postfix 3.6.4 with
Dovecot 2.3.17.1 (476cd46418).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have a multi-signed cert from
Entrust.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The cert works fine on port 25.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, on Port 587 I get an
error: c<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[root@mcq wbs]# openssl s_client
-connect mcq.sbanetweb.com:993 -servername
mcq.sbanetweb.com<o:p></o:p></p>
<p class="MsoNormal">CONNECTED(00000003)<o:p></o:p></p>
<p class="MsoNormal">depth=0 C = US, ST = New York, L =
Bellmore, O = SBA Consulting LTD, CN =
mcq.sbanetweb.com<o:p></o:p></p>
<p class="MsoNormal">verify error:num=20:unable to get
local issuer certificate<o:p></o:p></p>
<p class="MsoNormal">verify return:1<o:p></o:p></p>
<p class="MsoNormal">depth=0 C = US, ST = New York, L =
Bellmore, O = SBA Consulting LTD, CN =
mcq.sbanetweb.com<o:p></o:p></p>
<p class="MsoNormal">verify error:num=21:unable to
verify the first certificate<o:p></o:p></p>
<p class="MsoNormal">verify return:1<o:p></o:p></p>
<p class="MsoNormal">depth=0 C = US, ST = New York, L =
Bellmore, O = SBA Consulting LTD, CN =
mcq.sbanetweb.com<o:p></o:p></p>
<p class="MsoNormal">verify return:1<o:p></o:p></p>
<p class="MsoNormal">---<o:p></o:p></p>
<p class="MsoNormal">Certificate chain<o:p></o:p></p>
<p class="MsoNormal">0 s:C = US, ST = New York, L =
Bellmore, O = SBA Consulting LTD, CN =
mcq.sbanetweb.com<o:p></o:p></p>
<div style="border:none;border-bottom:solid windowtext
1.0pt;padding:0in 0in 1.0pt 0in">
<p class="MsoNormal"> i:C = US, O = "Entrust, Inc.",
OU = See <a
href="http://www.entrust.net/legal-terms"
moz-do-not-send="true">www.entrust.net/legal-terms</a>,
OU = "(c) 2012 Entrust, Inc. - for authorized use
only", CN = Entrust Certification Authority - L1K<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[root@mcq wbs]# dovecot -n<o:p></o:p></p>
<p class="MsoNormal"># 2.3.17.1 (476cd46418):
/etc/dovecot/dovecot.conf<o:p></o:p></p>
<p class="MsoNormal"># OS: Linux 5.16.5-200.fc35.x86_64
x86_64 Fedora release 35 (Thirty Five)<o:p></o:p></p>
<p class="MsoNormal"># Hostname: mcq.sbanetweb.com<o:p></o:p></p>
<p class="MsoNormal">auth_mechanisms = plain login<o:p></o:p></p>
<p class="MsoNormal">disable_plaintext_auth = no<o:p></o:p></p>
<p class="MsoNormal">mbox_write_locks = fcntl<o:p></o:p></p>
<p class="MsoNormal">namespace inbox {<o:p></o:p></p>
<p class="MsoNormal"> inbox = yes<o:p></o:p></p>
<p class="MsoNormal"> location =<o:p></o:p></p>
<p class="MsoNormal"> mailbox Drafts {<o:p></o:p></p>
<p class="MsoNormal"> special_use = \Drafts<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> mailbox Junk {<o:p></o:p></p>
<p class="MsoNormal"> special_use = \Junk<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> mailbox Sent {<o:p></o:p></p>
<p class="MsoNormal"> special_use = \Sent<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> mailbox "Sent Messages" {<o:p></o:p></p>
<p class="MsoNormal"> special_use = \Sent<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> mailbox Trash {<o:p></o:p></p>
<p class="MsoNormal"> special_use = \Trash<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> prefix =<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal">passdb {<o:p></o:p></p>
<p class="MsoNormal"> driver = pam<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal">protocols = imap<o:p></o:p></p>
<p class="MsoNormal">service auth {<o:p></o:p></p>
<p class="MsoNormal"> unix_listener
/var/spool/postfix/private/auth {<o:p></o:p></p>
<p class="MsoNormal"> group = postfix<o:p></o:p></p>
<p class="MsoNormal"> mode = 0666<o:p></o:p></p>
<p class="MsoNormal"> user = postfix<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> unix_listener auth-userdb {<o:p></o:p></p>
<p class="MsoNormal"> group = postfix<o:p></o:p></p>
<p class="MsoNormal"> mode = 0666<o:p></o:p></p>
<p class="MsoNormal"> user = postfix<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal">service imap-login {<o:p></o:p></p>
<p class="MsoNormal"> inet_listener imap {<o:p></o:p></p>
<p class="MsoNormal"> port = 143<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> inet_listener imaps {<o:p></o:p></p>
<p class="MsoNormal"> port = 993<o:p></o:p></p>
<p class="MsoNormal"> ssl = yes<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal">service submission-login {<o:p></o:p></p>
<p class="MsoNormal"> inet_listener submission {<o:p></o:p></p>
<p class="MsoNormal"> port = 587<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal">ssl = required<o:p></o:p></p>
<p class="MsoNormal">ssl_cert =
</etc/postfix/tls/ServerCertificate.pem<o:p></o:p></p>
<p class="MsoNormal">ssl_cipher_list =
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA<o:p></o:p></p>
<p class="MsoNormal">ssl_client_ca_dir =
/etc/postfix/tls/<o:p></o:p></p>
<p class="MsoNormal">ssl_client_ca_file =
ChainBundle.pem<o:p></o:p></p>
<p class="MsoNormal">ssl_dh = # hidden, use -P to show
it<o:p></o:p></p>
<p class="MsoNormal">ssl_key = # hidden, use -P to show
it<o:p></o:p></p>
<p class="MsoNormal">ssl_prefer_server_ciphers = yes<o:p></o:p></p>
<p class="MsoNormal">userdb {<o:p></o:p></p>
<p class="MsoNormal"> driver = passwd<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal">protocol imap {<o:p></o:p></p>
<p class="MsoNormal"> mail_max_userip_connections = 15<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any ideas?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Wayne Spivak<o:p></o:p></p>
<p class="MsoNormal">SBANETWEB.com<o:p></o:p></p>
</blockquote>
</div>
<div>
<div>
<p class="MsoNormal">-- <br>
Sent from my Android device with K-9 Mail. Please
excuse my brevity.<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
<div style="white-space: pre-wrap"><div class="k9mail-signature">--
Sent from my Android device with K-9 Mail. Please excuse my brevity.</div></div>
</blockquote>
</body>
</html>