1 (edited by heeter 2021-04-12 10:59:42)

Topic: Nonweb facing Iredmail server needs certs

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- 1.3.1
- Downloadable installer
- Ubuntu 18.04.5 LTS
- Mysql 5.7.33
- nginx/1.14.0 (Ubuntu)
- iRedamin non pro v1.0
====


Hi all,

I have a fully functioning iredmail mail server. It is not webfacing, router ports 25, 587, 993 are only ones open to server. NGINX is installed but service has been stopped for a while.

Installed worpress and nextcloud on my other web server with nginx and I am trying to use the smtp from the iredmail server, wordpress is complaining that it can't connect to mail.mydomain.com because certs are not configured.

There was a problem while sending the test email.

Misconfigured server certificate.
This means OpenSSL on your server isn't able to verify the host certificate.

There are a few reasons why this is happening. It could be that the host certificate is misconfigured, or this server's OpenSSL is using an outdated CA bundle.

Certbot is installed on iredmail server, but it hasn'tupdated since Jan 2020.

root@mail:/home/adminpc# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
OCSP check failed for /etc/letsencrypt/live/mail.domain1.com/cert.pem (are we offline?)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: mail.domain1.com
    Domains: mail.domain1.com
    Expiry Date: 2020-03-14 04:22:10+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/mail.domain1.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/mail.domain1.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@mail:/home/adminpc# 

What can I do to fix this?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Nonweb facing Iredmail server needs certs

You must enable nginx, at least to update the letsencrypt certificate  *before* it expires.
The renewal process can't work if it can't access port 80 to check the host.

Then you do a   # certbot renew     to manually force the certificate renew.
If it's already expired, you have to create a new one.

https://docs.iredmail.org/letsencrypt.html

3

Re: Nonweb facing Iredmail server needs certs

Great Thank you