Cannot connect using ssl (iphone email error)

Help
21

yep.

how to install a cert in a mailserver goes beyond my knowledge, though.

1 Like
22

thanksā€¦ iā€™m going to try and use server.eyethrees.net as my mail server and see how that goes

23

no, wait. mail.eyethrees.net is among the names for which that one cert is valid for. you donā€™t need to change domain.

24

@9peppe good catch! Outta sight outta mind.

1 Like
25

oh interestingā€¦ i cancelled the cerbot --apache -d {list of my domains with the mail. one added} when it got to the point of asking about the vhost

26

and btw, iā€™m still not able to add the account in my iphone
i get the ā€œcannot connect using sslā€ message
i can send mail from the command line but iā€™m not receiving mail
testing using online tools like mxtoolbox.com and mail-tester.com both show everything is ok

27

if I visit https://mail.eyethrees.net/ I get a self signed cert, you should really install the LE certificate :smiley:

(ie: How to use Let's Encrypt certificates with Postfix/Dovecot software)

28

i have the LE cert in the dovecot and postfix configs
(at least i think so)
guess itā€™s time to doublecheck

29

@ccheath try dumping your cache on the iPhone. I had a similar issue on an iPad and after a short ā€œDUHā€ moment (and dumping cache and history) it reloaded what I expected to see.

Might help
Rip

30

in safari?
hmm seems unrelated but iā€™ll give it a shot

31

have you restarted/reloaded both?

1 Like
32

Just a thoughtā€¦ I now assume youā€™re using one of the mail apps.

1 Like
33

yes i definitely have

34

yeah the main mail app

35

clearing the cache didnā€™t help

so iā€™m gonna post my postfix and dovecot configs maybe someone can see something wrong

doveconf -n

$sudo doveconf -n
# 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf
# OS: Linux 3.10.0-327.4.4.el7.centos.plus.x86_64 x86_64 CentOS Linux release 7.7.1908 (Core) 
# Hostname: server.eyethrees.net
auth_mechanisms = plain login
first_valid_uid = 1000
mail_location = maildir:~/Maildir
mbox_write_locks = fcntl
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  driver = pam
}
protocols = imap
service auth {
  unix_listener auth-userdb {
    group = postfix
    mode = 0666
    user = postfix
  }
}
ssl_cert = </etc/letsencrypt/live/server.eyethrees.net/fullchain.pem
ssl_key =  # hidden, use -P to show it
userdb {
  driver = passwd
}

postconf -n

$sudo postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Maildir/
html_directory = no
inet_protocols = all
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
milter_default_action = accept
mydestination = $myhostname, localhost.$mydomain, $mydomain
myhostname = mail.eyethrees.net
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
non_smtpd_milters = $smtpd_milters
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_milters = inet:127.0.0.1:8891
smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination permit_sasl_authenticated
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/server.eyethrees.net/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/server.eyethrees.net/privkey.pem
smtpd_tls_security_level = may
unknown_local_recipient_reject_code = 550
virtual_alias_domains = eyethrees.net
virtual_alias_maps = hash:/etc/postfix/virtual
36

i think my problem is not with postfix or dovecot but with dns or maybe the self signed cert (which iā€™m trying to figure out how/why that is happening right now)

37

ok iā€™ve fixed the self-signed cert at mail.eyethrees.net to be the LE cert now

i had to create a mail.eyethrees.net vhost directory and entry in my httpd.conf

edit1: still not able to add the account in my iphone tho

edit2: when i try to use thunderbird to login it recognizes mail.eyethrees.net as and IMAP and SMTP server but it fails to complete setup of the account with a message that either the authentication or configuration is incorrect :frowning:

38

is this helpful?

% nmap mail.eyethrees.net
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-07 22:50 CET
Nmap scan report for mail.eyethrees.net (108.161.131.209)
Host is up (0.16s latency).
rDNS record for 108.161.131.209: server.eyethrees.net
Not shown: 991 filtered ports
PORT      STATE  SERVICE
25/tcp    open   smtp
80/tcp    open   http
110/tcp   closed pop3
143/tcp   open   imap
443/tcp   open   https
465/tcp   closed smtps
587/tcp   open   submission
3306/tcp  open   mysql
10000/tcp open   snet-sensor-mgmt

Nmap done: 1 IP address (1 host up) scanned in 11.23 seconds

(I see no imaps)

1 Like
39

hmm interestingā€¦ i thought that imap itself was sufficient ā€¦ let me go back to firewalld and see what i can see about imaps

40

smtps too, ehā€¦ smtp and imap are not going to be encrypted by themselves.

1 Like