Mailserver Certifacte shows the wrong domain

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: die aktiven.de // mail.webcam-team2.de

I ran this command:

service apache2 stop
certbot certonly --standalone --rsa-key-size 2048 -d mail.webcam-team2.de
service apache2 start
service postfix reload
service dovecot reload

It produced this output:

My web server is (include version): Apache2

The operating system my web server runs on is (include version): Linux

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.2.0

I ran the commands as always, i did not change anything and now I have a domain mismatch.
With the command:
openssl s_client -connect mail.webcam-team2.de.com:443 -servername mail.webcam-team2.de
I got this result:

verify return:1
depth=2 C = US, O = ISRG, CN = Root YR
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = YR2
verify return:1
depth=0 CN = dieaktiven.de
verify return:1

With the command:
certbot certificates
I got this results:
Certificate Name: dieaktiven.de
Domains: dieaktiven.de www.dieaktiven.de
Expiry Date: 2026-11-05 13:23:59+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/dieaktiven.de/fullchain.pem
Private Key Path: /etc/letsencrypt/live/dieaktiven.de/privkey.pem

Certificate Name: mail.webcam-team2.de
Domains: mail.webcam-team2.de
Expiry Date: 2026-11-05 13:25:25+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/mail.webcam-team2.de/fullchain.pem
Private Key Path: /etc/letsencrypt/live/mail.webcam-team2.de/privkey.pem

Postfix Main.cf shows this:
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.webcam-team2.de/fullchain.pem
smtpd_tls_loglevel=1
smtpd_use_tls=yes
smtpd_tls_protocols=!SSLv2,!SSLv3
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtp_use_tls=yes
smtp_tls_cert_file=/etc/letsencrypt/live/mail.webcam-team2.de/fullchain.pem
smtp_tls_key_file=/etc/letsencrypt/live/mail.webcam-team2.de/privkey.pem
smtp_tls_loglevel=1
smtp_tls_protocols=!SSLv2,!SSLv3

Dovecot 10-ssl.conf
ssl_cert = </etc/letsencrypt/live/mail.webcam-team2.de/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.webcam-team2.de/privkey.pem

Whre is my fault? I am a little helpless. Please give me a hint. The certifates run until yesterday without any problems.

Thx a lot

2

The port 443 you're connecting to is most likely served by Apache and not by your mainserver(s). You need different ports for SMTP and IMAP.

3

Which command I used was wrong, or can you give me the corrext command for creating the certificate using postfix. Smtp is running on port 587.

4

There you're using 443.

If you connect to Apache, you're not testing Postfix/Dovecot obviously.

5

You also need to indicate SMTP for openssl. Which looks fine to me. Add -servername if your openssl is old and needs that.

Like:

echo|openssl s_client -connect mail.webcam-team2.de:587 -starttls smtp

CONNECTED(00000003)
depth=3 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=2 C = US, O = ISRG, CN = Root YR
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = YR1
verify return:1
depth=0 CN = mail.webcam-team2.de
verify return:1
---
Certificate chain
 0 s:CN = mail.webcam-team2.de
   i:C = US, O = Let's Encrypt, CN = YR1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Aug  7 13:25:26 2026 GMT; NotAfter: Nov  5 13:25:25 2026 GMT
 1 s:C = US, O = Let's Encrypt, CN = YR1
   i:C = US, O = ISRG, CN = Root YR
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2028 GMT
 2 s:C = US, O = ISRG, CN = Root YR
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
6

Thx a lot for your patience, but when I test the mailserver with https://ssl-tools.net
I got an error with the result: Results incomplete (unexpected EOF).
So I am confused.

7

Maybe let's start over a bit. What problem are you actually trying to solve, by using these openssl commands and online tools?

8

The update of the the existing certificate works fine. As always I checked the functionality of the mailserver certificate the domain ssl-tools.net and there I get the errors as subscriped after a refresh after the update. Thats what I am looking for.
The command

echo|openssl s_client -connect mail.webcam-team2.de:587 -starttls smtp

shows no errors, but why is there an error in the online tool

9

I think you should contact that online tool and ask them why it is failing. I never saw the "EOF" error when testing your site with that tool. From their site I get an error as it sees a connection using a self-signed cert (see here). I never saw this self-signed cert using other tools (or openssl). But without knowing exactly how that tool is trying to connect it is hard to say what is happening. An "EOF" usually means whatever it connected to does not recognize their connection request. Show them the openssl command that works.

Besides, you agree the cert is fine and even shows correct using openssl. So, if there are further errors with your mail server you are better served asking a postfix/dovecot forum for help.

Are you having failures with sending or receiving mail? Or is it just this testing tool? That is helpful info for that tool's support team and the postfix/dovecot forum to know.

You used the wrong domain name in that openssl example. Your domain ends in .de but you used .de.com in that command. You don't have an A or AAAA record for the .de.com domain name and you never got a cert for that name either.