I am having trouble with site mailtest.example.com, ubuntu 16.4 installed fresh, in hosts hostname is set to mailtest.example.cm, iRedmail installed with nginx, DNS pointed to IP address and it kinda works, but with self-signed certs. Certbot will not install them automatically, When I try manually by removing comments in etc/nginx/templates/ssl.tmpl that goes like this:
ssl on;
ssl_protocols TLSv1.2;
# Fix 'The Logjam Attack'.
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/dh2048_param.pem;
# To use your own ssl cert (e.g. LetsEncrypt), please create symbol link to
# ssl cert/key used below, so that we can manage this config file with Ansible.
#
# For example:
#
# rm -f /etc/ssl/private/iRedMail.key
# rm -f /etc/ssl/certs/iRedMail.crt
# ln -s /etc/letsencrypt/live/mailtest.arcanet.com.mt/privkey.pem /etc/ssl/private/iRedMail.key
# ln -s /etc/letsencrypt/live/mailtest.arcanet.com.mt/fullchain.pem /etc/ssl/certs/iRedMail.crt
#
ssl_certificate /etc/ssl/certs/iRedMail.crt;
ssl_certificate_key /etc/ssl/private/iRedMail.key;
and certificates start to work, however, nginx cash and I am presented with the index page that I have setup nginx instead of the mail client. Puting #'s back on solves the crash but goes back to self-signed certificates. If anyone could help please do. Thank you in advance
If the answer is yes then don’t do that, those are the commands you should run as root to link LE certificates into the right place so iRedMail can read them but you should NOT remove the # in that file.
yes that is what I was saying. But even when I run them as root It does not help, I still have self assigned key.
I also tried to edit in sited-available
00-defoult-ssl file and to add
ssl_certificate /etc/letsencrypt/live/mailtest.arcanet.com.mt/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mailtest.arcanet.com.mt/privkey.pem;
but I had no luck aswell.
What seems to be the problem when that is done is that files original and the ones copied into iRedMail.crt and key are the same,but still its visible as self signed key.
Is there maybe a way you could help me with that? Thank you
The certificate is a self-signed one so, either the commands issued to link it to your LE certificate didn’t work as expected or iRedMail is recreating the self-signed cert once and again.
Could you please show the ouput of these commands (all of them):
ls -l /etc/ssl/private/iRedMail.key /etc/ssl/certs/iRedMail.crt
openssl x509 -in /etc/letsencrypt/live/mailtest.arcanet.com.mt/fullchain.pem -noout -text | grep -Ei '(Before:|Issuer:|DNS:)' | sed "s/^[ \t]*//"
that would be the output of the 1st one,and regardng 2nd its:
root@mailtest ~ # ls -l /etc/letsencrypt/live/ /etc/letsencrypt/archive/
ls: cannot access '/etc/letsencrypt/archive/': No such file or directory
/etc/letsencrypt/live/:
total 4
Thank you for all the help,hope this will help you help me resolve my isssue. Thanks
@Rohirrimus, seems you have copied the self-signed certificate into/etc/letsencrypt/live/mailtest.arcanet.com.mt/ and it is clear that you have removed the dir /etc/letsencrypt/archive/ and I don’t know whether you remoed or changed something else… so seems you messed it just a bit ;). You have already issued a valid certificate for your domain so I’m wondering what you did…
Also, you didn’t show the entire ouput of this command:
ls -l /etc/letsencrypt/live/ /etc/letsencrypt/archive/
My advise, read carefully the iRedMail installation guide and start over following step by step to configure it.
The problem is that since I rebuild server few times trying to fix problems with certs, LetsEncrypt didn’t want to issue me any more certs , so I got copy of ones from before,but they are the same,same domain.
Correct, you have reached the 5 duplicated certificates per 7 days limit:
CRT ID CERT TYPE DOMAIN (CN) VALID FROM VALID TO EXPIRES IN SANs
576752899 Pre cert mailtest.arcanet.com.mt 2018-Jul-05 12:21 UTC 2018-Oct-03 12:21 UTC 85 days mailtest.arcanet.com.mt
576561692 Pre cert mailtest.arcanet.com.mt 2018-Jul-05 12:17 UTC 2018-Oct-03 12:17 UTC 85 days mailtest.arcanet.com.mt
576487019 Pre cert mailtest.arcanet.com.mt 2018-Jul-05 11:17 UTC 2018-Oct-03 11:17 UTC 85 days mailtest.arcanet.com.mt
575007716 Pre cert mailtest.arcanet.com.mt 2018-Jul-04 11:29 UTC 2018-Oct-02 11:29 UTC 84 days mailtest.arcanet.com.mt
574921867 Pre cert mailtest.arcanet.com.mt 2018-Jul-04 09:25 UTC 2018-Oct-02 09:25 UTC 84 days mailtest.arcanet.com.mt
You could issue a new certificate for mailtest.arcanet.com.mt on 2018-Jul-11 10:25 UTC so you can wait 2 days or could override that limit adding a new domain so if you issue a certificate covering mailtest.arcanet.com.mt and for example mailtest2.arcanet.com.mt you could issue a new cert right now.
Seems you didn't copy the right ones because you are using the self-signed certificate instead of the one issued by Let's Encrypt.