1

Topic: Cannot connect to mail server, following letsencrypt renewal

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.9 PGSQL edition.
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version: Ubuntu 18.04.3 LTS
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): PGSQL
- Web server (Apache or Nginx):Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

My Lets Encrypt Certificates expired for my mail domain, and ftp, after renewing them I can no longer connect to my mail server, I am presneted with the following errror;

-----

Your connection is not private
Attackers might be trying to steal your information from mail.emporion.co.uk (for example, passwords, messages or credit cards). Learn more
NET::ERR_CERT_COMMON_NAME_INVALID
Subject: emporion.co.uk

Issuer: Let's Encrypt Authority X3

Expires on: 16 Mar 2020

Current date: 17 Dec 2019

----

At first I could not renew my certificates with the standard certbot renew command, as it kept failing the HTTP-01 Challenge, using the --nginx argument allowed me to renew the certificates, but has not fixed the issue with my mail server. FTP is working perfectly fine, with the renewed certificate.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Cannot connect to mail server, following letsencrypt renewal

You need to restart Postfix/Dovecot/Nginx after renewed the cert to load new cert.

3

Re: Cannot connect to mail server, following letsencrypt renewal

ZhangHuangbin wrote:

You need to restart Postfix/Dovecot/Nginx after renewed the cert to load new cert.

I have! and rebooted the server, also to no avail!

4

Re: Cannot connect to mail server, following letsencrypt renewal

Please double check Postfix/Nginx/Dovecot config files, make sure they're loading correct ssl cert/key files.