1 Topic by ag

  • ag
  • Member
  • Offline
  • Registered: 2012-12-10
  • Posts: 52

Topic: Certificate pop-up while opening Mail Client

======== Required information ====
- iRedMail version: 0.8.3
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Linux/BSD distribution name and version: Debian 6
- Related log if you're reporting an issue:
====

Hi,
How can i disable this anoying window while opening Windows Live or Outlook Express about:

"Server which you are conected with is using certificate which can't be checked. (...) Do you still want to use this server?"

(it's translated so I don't know how it sound in english)

I have to click "Yes" and mail works ok, but if I press "No" I get banned by fail2ban after couple of connection attempts.

How can I turn off this window? Or how can I add to the fail2ban whitelist my IP but only for postfix (I don't want to whitelist all services because of security - i still wan't to ban users from my ip which enter wrong password for ftp or ssh).

Is it possible?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by hdco (edited by hdco 2014-10-31 01:08:02)

  • hdco
  • Member
  • Offline
  • From: Vancouver, BC
  • Registered: 2014-10-02
  • Posts: 44

Re: Certificate pop-up while opening Mail Client

You're getting that message because you're using a self-signed SSL certificate, which is the default for iRedMail. You have three options:

1. Don't use SSL (not recommended)

2. Make an exception for your self-signed certificate in Outlook. Every person who uses email on your server will need to do this. http://support.microsoft.com/kb/2006728 - Doing this will not get rid of the message when accessing webmail though.

3. Purchase an SSL certificate. They're only $9.99/year at name.com and easy to set up, you just need to replace iRedMail's certificate file with the paid one. This is best option. (StartSSL actually offers free certificates, but I'm not sure how good they are... I'd rather just pay $10/yr to a reputable company)

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Certificate pop-up while opening Mail Client

Thanks hdco for the clear explanation. And yes, #3 (purchase a ssl certificate) is the best option.

4 Reply by ag

  • ag
  • Member
  • Offline
  • Registered: 2012-12-10
  • Posts: 52

Re: Certificate pop-up while opening Mail Client

Thank you for your answer.

One more thing, in first I thought that because of this windows people from IP get banned (they press no or ignore it) but I finally figure out why they get banned. Fail2ban keep ban this IP because two people had in their outbox email to the incorrect email address and while Windows Live synchronize it keep trying to send this messages (I have no idea how they were able to work like this and it was not pissing them off). They are in other office and I was not able to just check their mail program. Finally I found this wrong address in logs at the server.

One of the email was in the server domain for example maail@mydomain.com (double letters befor @) an other was mail@otherdomain.co (missing m at the end). And finally my question smile why fail2ban keep banning this IP ? It was because of mistake at mydomain.com ?

5 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Certificate pop-up while opening Mail Client

We have several filters to extract log content in Fail2ban (configured in /etc/fail2ban/jail.local), then Fail2ban scans mail log files with these filters. if some log line matches the filter, Fail2ban will track the IP address. If it matches several times (usually, 5 times) in a short period, Fail2ban will invoke iptables to ban this IP.

That's how it works.

Incorrect mail address won't trigger this ban, but failed password authentication will.

6 Reply by ag (edited by ag 2014-12-16 18:18:00)

  • ag
  • Member
  • Offline
  • Registered: 2012-12-10
  • Posts: 52

Re: Certificate pop-up while opening Mail Client

I know that it was over one month but i have to get back to this problem with banning IP.

Today I had the same situation aaa@mydomain.com try to send e-mail to bbb@mydomain.com (bbb@mydomian.com does not exist) and after couple tryouts IP of aaa@mydomain.com get banned by Fail2Ban-Postfix.

What can I check more?

Is it possible to set some kind of delivery error, because employes don't check the outgoing folder and just keeping sending next e-mails which don't get send because of the problem with this first one. Maybe the message could be just send and in sometime send some error e-mail to the sender?

7 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Certificate pop-up while opening Mail Client

ag wrote:

Today I had the same situation aaa@mydomain.com try to send e-mail to bbb@mydomain.com (bbb@mydomian.com does not exist) and after couple tryouts IP of aaa@mydomain.com get banned by Fail2Ban-Postfix.

Update your Fail2ban filter to ignore this kind of error message.

8 Reply by ag

  • ag
  • Member
  • Offline
  • Registered: 2012-12-10
  • Posts: 52

Re: Certificate pop-up while opening Mail Client

I have to go back for this old thread, sorry.

I've used hdco tip number 2 (i use windows live so it looks a little bit different), I've extracted .crt file from iRedMail_CA.pem, i've added this .crt to windows live but now I get:

"The server you are connect to is using a security certificate that could not be verified.
The certificate's CN name does not match the passed value.
Do you want to continue using this server? YES or NO?"

CN in my .crt is the name of the server and I have couple of domains so I'm not able to set one fixed CN

9 Reply by 7t3chguy

  • 7t3chguy
  • 7t3chguy
  • Forum Moderator
  • Offline
  • From: United Kingdom
  • Registered: 2015-01-08
  • Posts: 713

Re: Certificate pop-up while opening Mail Client

You will have to generate a new Self-Signed Certificate with multiple CNs.

7t3chguy's Website