Dovecot mail server certifcate

Help
1

I run an unmanaged centos server and have recently updated all domains to https:// with no real problems but in the process I found odd links to an expired certificate that was on the server when I leased it that has stumped me!

Letencrypt provides 4 x .pem files that work but Dovecot seems to use .key and .crt files.

As this is all new to me even for a command line user, help please.

The server is server.watchet.net but the original stuff was under watchetwebdesign.co.uk but works on Dovecot without error. Maybe I am missing something obvious…

There are 3 entries:-

etc/pki/dovecot/certs which include

watchetwebdesign.co.uk.csr
localhost.key
watchetwebdesign.co.uk.key

Then at /root/watchetwebdesign.co.uk directory includes

watchetwebdesign.co.uk.csr
watchetwebdesign.co.uk.key
watchetwebdesign.co.uk/crt
(not the same files in pki I think)

Then etc/ssl/certs directory includes

watchetwebdesign.co.uk.crt

All I need to do is use the current certificate for server.watchet.net
or update this version of the wwd cert.

Cheers
John
UK

2

Do you have a certificate for the hostname server.watchet.net? crth.sh doesn't have a record of a certificate for that hostname. Is that also the exact hostname users are entering into their mail client to connect to Dovecot?

3

Hi lots of work later, sorted out most of the Dovecot cert stuff. had to delete a load of old certificates installed by the server provider, then got a cert for server.watchet.net and then changed the dovecot config files (was confused over .pem and .key and didn’t realise dovecot would accept any suffix providing it was a key.

Great BUT (always one of them!) the mailboxes are just users on the server without and mail is collected using the IP address not the server address (although the same) in this case if the IP is used client comes up with a cert/server mismatch. If say fred@server.watchet.net is used instead of fred@ IP then mail is fetched ssl with no problem,. It will take a while for my clients to use this if they have to, so would prefer to get a certifcate for the IP instead (it is permantly allocated to us) but 2 hours on the net have produced conflicting reports to say the least.

So, will letsencrypt give am IP server cert or do i have to go to a paid organisation?

rgds
john
UK

4

Let’s Encrypt does not issue certificates for IP addresses (yet).

5

Hi @JRWatchet

using raw ip addresses with a mail client isn’t a good idea.

Domainname -> ip address.

So these users should only use the domain name.

6

Thanks for comments, just a pain to get everyone to change their email client - in otherwords I have to
visit a lot of my customers to show them how. Just using the IP is so much easier for customers than changing everything I set up…oh well if has to be done, has to be done! server.watchet.net is long!

Will try with some of the other virtual hosts as have a simpler jr-mail.co.uk domain.

Will keep looking for commercial idea as have to now set up sendmail to use TLS/SSL - more learning!
John

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.