1 Topic by PeachMaster

  • PeachMaster
  • Member
  • Offline
  • Registered: 2021-12-07
  • Posts: 2

Topic: issuer certificate not found for certificate "/etc/pki/tls/certs/iRedM

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):  1.4.2
- Deployed with iRedMail Easy or the downloadable installer? Downloadble Installer
- Linux/BSD distribution name and version:  AlamLinux 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):  MariaDB
- Web server (Apache or Nginx): NGINX
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Error Message:

nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/etc/pki/tls/certs/iRedMail.crt"

I am attempting to enable ssl_stapling, when I enabled it with the following add to my ssl.tmpl file:

ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.4.4 valid=300s;
resolver_timeout 5s;

I get the error:
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/etc/pki/tls/certs/iRedMail.crt"

I presume the iRedMail.crt is not a cert chain and only has the iRedMail info in it?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: issuer certificate not found for certificate "/etc/pki/tls/certs/iRedM

Do you use the default self-signed ssl cert or a valid one?

3 Reply by PeachMaster

  • PeachMaster
  • Member
  • Offline
  • Registered: 2021-12-07
  • Posts: 2

Re: issuer certificate not found for certificate "/etc/pki/tls/certs/iRedM

I am just using the default one which iRedMail installed, i presume to resolve this I can replace it with a letsencrypt SSL cert? (i do have one installed already for nginx for the iredmail server full FQDN)

4 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 815

Re: issuer certificate not found for certificate "/etc/pki/tls/certs/iRedM

well, do you really need oscp stapling?
for you to get this worked, you need a request for a stapling activated cert, which is not activated by default

what do you use, dehydrated, certbot, or any other tool?