26

Re: Outlook-ActiveSync Not Connecting

georgy.goshin wrote:
pnjo23 wrote:

And your SSL certificate, did you replace the default self signed cert with a trusted one?

I use Let's Encrypt. SOGO page is works good and show correct cert

One more idea - how do you reference the SSL certs? Best way is it to create symbolic links as described here https://docs.iredmail.org/letsencrypt.html as opposed to integrating the SSL certs into individual services (Nginx, Postfix etc) to be double sure nothing is missed.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

27

Re: Outlook-ActiveSync Not Connecting

I've rechecked every SSL config and found in dovecot.conf the following

#ssl_ca = </path/to/ca
ssl_cert = </etc/pki/tls/certs/iRedMail.crt
ssl_key = </etc/pki/tls/private/iRedMail.key

Replaced according to the manual to

ssl_ca = </etc/pki/tls/private/iRedMail.key

But this not helped at all - the server can not be found. Which path (port) is trying to open Outlook when checking this type of connection?

28

Re: Outlook-ActiveSync Not Connecting

packet sniffer shows some packets to port 443 and responses but of course I can't examine to while SSL

29

Re: Outlook-ActiveSync Not Connecting

georgy.goshin wrote:

I've rechecked every SSL config and found in dovecot.conf the following

#ssl_ca = </path/to/ca
ssl_cert = </etc/pki/tls/certs/iRedMail.crt
ssl_key = </etc/pki/tls/private/iRedMail.key

Replaced according to the manual to

ssl_ca = </etc/pki/tls/private/iRedMail.key

But this not helped at all - the server can not be found. Which path (port) is trying to open Outlook when checking this type of connection?

Change this back to default setting and create symbolic links as follows:
mv /etc/pki/tls/certs/iRedMail.crt{,.bak}       # Backup. Rename iRedMail.crt to iRedMail.crt.bak
mv /etc/pki/tls/private/iRedMail.key{,.bak}     # Backup. Rename iRedMail.key to iRedMail.key.bak
ln -s /etc/letsencrypt/live/mail.mydomain.com/fullchain.pem /etc/pki/tls/certs/iRedMail.crt
ln -s /etc/letsencrypt/live/mail.mydomain.com/privkey.pem /etc/pki/tls/private/iRedMail.key

30

Re: Outlook-ActiveSync Not Connecting

georgy.goshin wrote:

packet sniffer shows some packets to port 443 and responses but of course I can't examine to while SSL


Also when I'm trying to telnet to ports 80 or 443 from client to server ant type some commands like GET / I see the errors in nginx logs, but when Outlook trying to check the server, I see nothing in logs but can see the packets with the sniffer.

31

Re: Outlook-ActiveSync Not Connecting

Here is my current SSL related configuration

[root@ired nginx]# grep -r ssl /etc/dovecot/dovecot.conf /etc/nginx/templates/ssl.tmpl
/etc/dovecot/dovecot.conf:ssl_protocols = !SSLv2 !SSLv3
/etc/dovecot/dovecot.conf:ssl = required
/etc/dovecot/dovecot.conf:verbose_ssl = no
/etc/dovecot/dovecot.conf:ssl_ca = </etc/pki/tls/certs/iRedMail.crt
/etc/dovecot/dovecot.conf:ssl_cert = </etc/pki/tls/certs/iRedMail.crt
/etc/dovecot/dovecot.conf:ssl_key = </etc/pki/tls/private/iRedMail.key
/etc/dovecot/dovecot.conf:ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5
/etc/dovecot/dovecot.conf:ssl_prefer_server_ciphers = yes
/etc/dovecot/dovecot.conf:# With disable_plaintext_auth=yes AND ssl=required, STARTTLS is mandatory.
/etc/dovecot/dovecot.conf:# Set disable_plaintext_auth=no AND ssl=yes to allow plain password transmitted
/etc/dovecot/dovecot.conf:    #    ssl = yes
/etc/dovecot/dovecot.conf:    #    ssl = yes
/etc/nginx/templates/ssl.tmpl:ssl on;
/etc/nginx/templates/ssl.tmpl:ssl_protocols TLSv1.2;
/etc/nginx/templates/ssl.tmpl:ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5;
/etc/nginx/templates/ssl.tmpl:ssl_prefer_server_ciphers on;
/etc/nginx/templates/ssl.tmpl:ssl_dhparam /etc/pki/tls/dh2048_param.pem;
/etc/nginx/templates/ssl.tmpl:# To use your own ssl cert (e.g. LetsEncrypt), please create symbol link to
/etc/nginx/templates/ssl.tmpl:# ssl cert/key used below, so that we can manage this config file with Ansible.
/etc/nginx/templates/ssl.tmpl:ssl_certificate /etc/pki/tls/certs/iRedMail.crt;
/etc/nginx/templates/ssl.tmpl:ssl_certificate_key /etc/pki/tls/private/iRedMail.key;


And the files (links)

[root@ired nginx]# ls -l /etc/pki/tls/certs/iRedMail.crt /etc/pki/tls/certs/iRedMail.crt /etc/pki/tls/private/iRedMail.key /etc/pki/tls/certs/iRedMail.crt /etc/pki/tls/private/iRedMail.key
lrwxrwxrwx 1 root root 49 Dec 30 10:55 /etc/pki/tls/certs/iRedMail.crt -> /etc/letsencrypt/live/ired.X.com/fullchain.pem
lrwxrwxrwx 1 root root 49 Dec 30 10:55 /etc/pki/tls/certs/iRedMail.crt -> /etc/letsencrypt/live/ired.X.com/fullchain.pem
lrwxrwxrwx 1 root root 49 Dec 30 10:55 /etc/pki/tls/certs/iRedMail.crt -> /etc/letsencrypt/live/ired.X.com/fullchain.pem
lrwxrwxrwx 1 root root 47 Dec 25 17:59 /etc/pki/tls/private/iRedMail.key -> /etc/letsencrypt/live/ired.X.com/privkey.pem
lrwxrwxrwx 1 root root 47 Dec 25 17:59 /etc/pki/tls/private/iRedMail.key -> /etc/letsencrypt/live/ired.X.com/privkey.pem

32

Re: Outlook-ActiveSync Not Connecting

OK, switching the NGINX log level shows the following

SSL_do_handshake() failed (SSL: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol) while SSL handshaking

33

Re: Outlook-ActiveSync Not Connecting

georgy.goshin wrote:

OK, switching the NGINX log level shows the following

SSL_do_handshake() failed (SSL: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol) while SSL handshaking

Your Nginx is set to only accept TLS1.2 connections, yet your outlook is negotiating handshake with weaker TLS/SSL protocol. Try allowing TLS 1.1 / 1.0 in Nginx to test.

34

Re: Outlook-ActiveSync Not Connecting

OK, I found the workaround

ssl_protocols TLSv1 TLSv1.2;

TLSv1 is necessary in NGINX SSL configuration

35

Re: Outlook-ActiveSync Not Connecting

georgy.goshin wrote:

OK, I found the workaround

ssl_protocols TLSv1 TLSv1.2;

TLSv1 is necessary in NGINX SSL configuration

Problem resolved now?

36

Re: Outlook-ActiveSync Not Connecting

Yes, the problem was in NGINX's SSL config