You’re setting options so your RoundCube will verify the server’s certificate, correct?
// The example below enables server certificate validation
(From RoundCube’s defaults.inc.php)
What are you trying to achieve with putting your private key in a PKCS12 format? Where did you read about these procedures?
Because the only thing you’d need to do is point cafile to chain.pem and that’s it: that way it will verify the servers certificate with Let’s Encrypts Intermediate certificate. Or it should point to the DST Root CA X3 (see https://letsencrypt.org/certificates/ somewhere in the middle) and your IMAP and SMTP server should provide the intermediate certificate (it should do that anyway).
I pointed to /etc/letsencrypt/live/mail.mydomain.com/chain.pem but error log said like this:
SMTP:
[18-Sep-2016 12:50:45 UTC] PHP Warning: failed loading cafile stream: `/etc/letsencrypt/live/mail.mydomain.com/chain.pem' in /var/www/secure_html/for_users/webmail/vendor/pear-pear.php.net/Net_Socket/Net/Socket.php on line 158
[18-Sep-2016 12:50:45 UTC] PHP Warning: stream_socket_client(): Failed to enable crypto in /var/www/secure_html/for_users/webmail/vendor/pear-pear.php.net/Net_Socket/Net/Socket.php on line 158
[18-Sep-2016 12:50:45 UTC] PHP Warning: stream_socket_client(): unable to connect to ssl://localhost:465 (Unknown error) in /var/www/secure_html/for_users/webmail/vendor/pear-pear.php.net/Net_Socket/Net/Socket.php on line 158
[18-Sep-2016 12:50:45 UTC] ERROR: stream_socket_client(): unable to connect to ssl://localhost:465 (Unknown error) (0)
[18-Sep-2016 12:50:45 UTC] ERROR: Failed to connect socket: stream_socket_client(): unable to connect to ssl://localhost:465 (Unknown error) ()
IMAP:
[18-Sep-2016 12:51:25 UTC] PHP Warning: failed loading cafile stream: `/etc/letsencrypt/live/mail.mydomain.com/chain.pem' in /var/www/secure_html/for_users/webmail/program/lib/Roundcube/rcube_imap_generic.php on line 948
[18-Sep-2016 12:51:25 UTC] PHP Warning: stream_socket_client(): Failed to enable crypto in /var/www/secure_html/for_users/webmail/program/lib/Roundcube/rcube_imap_generic.php on line 948
[18-Sep-2016 12:51:25 UTC] PHP Warning: stream_socket_client(): unable to connect to ssl://localhost:993 (Unknown error) in /var/www/secure_html/for_users/webmail/program/lib/Roundcube/rcube_imap_generic.php on line 948
And I tried DST Root CA X3 but got the same results.
At first, I pointed cert.pem but I got above error, so I tried another one.
Hmm, reading the following: http://php.net/manual/en/migration56.openssl.php it seems PHP verifies the certificates by default… So do you really need to set the cafile et cetera? Doesn’t it just work out of the box?
your first log was on RoundCube side, while the second is Postfix.
my guess is your postfix certificate was not correctly set up.
for example not giving chain cert.