My domain is: antiochtechnologies.com
My web server is (include version): apache 2.4.18
The operating system my web server runs on is (include version): ubuntu 16.04
I can login to a root shell on my machine (yes or no, or I don’t know): y
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): webmin 1.902
suddenly having email issues that ive tracked down to certificate issues. when i check antiochtechnologies.com, it checks out fine. but when i check out any of the san names under that certificate, i get name mismatch issues that point to another domain hosted on that machine. kinda lost here…
my certificates were all initially, and to this day, obtained via the webmin implementation.
antiochtechnologies.com and antiochtech.com are intentionally separate. antiochtech.com is a vhost, the other domain is solely for webmin’s purposes, as per their recommendation. this is how it has been setup, and has worked flawlessly, for years.
now i cant say that ive ever bothered to look up mail.antiochtechnologies.com’s certificate, but it seems odd that it comes back with a totally different domain. i should also note that after the recent trouble began, and before i posted here, it returned another domain for a disused vhost instead. after deleting that disused vhost, it switched to antiochtech.com. i should also note that the now eliminated disused vhost’s domain came, alphabetically, just before antiochtech.com.
I'm not familiar with Webmin. personally, I use cPanel and Plesk.
I think it happens because Webmin only binds 1 hostname now, which is antiochtechnologies.com and does not cover the www version. However, I can't find a working solution to resolve this by only searching on the internet...
But talking about the www version of your domain, you actually might see that the certificate issued for this domain does not include the www version (it includes mail and other subdomains). I guess that's why it falls back to the tech.com one.
So maybe the better solution is:
Issue a certificate yourself (from the letsencrypt plugin) and include all subdomains on this certificate (crt.sh | 1410490748) plus the www version.
Using this tutorial Securing Webmin - Webmin Documentation, bind the issued certificate to your server certificate. (The tutorial might be a little bit outdated, hope it will help)
If this doesn’t work (It really might not work)…
You might need to add your domain as a virtual host on the server and add https for that whole virtualhost.
(You could also try to ask this question on webmin community)
is the issue on line 4 where the vhost is listed as the default server for port 443, instead of antiochtechnologies.com?
[Mon Apr 29 22:37:47.366085 2019] [so:warn] [pid 10142] AH01574: module dav_module is already loaded, skipping
VirtualHost configuration:
216.235.107.56:443 is a NameVirtualHost
default server antiochtech.com (/etc/apache2/sites-enabled/antiochtech.com.conf:55)
port 443 namevhost antiochtech.com (/etc/apache2/sites-enabled/antiochtech.com.conf:55)
alias www.antiochtech.com
alias autoconfig.antiochtech.com
alias autodiscover.antiochtech.com
port 443 namevhost antiochtechnologies.com (/etc/apache2/sites-enabled/antiochtechnologies.com.conf:1)
port 443 namevhost vhostdomain1.tld (/etc/apache2/sites-enabled/vhostdomain1.tld.conf:62)
alias www.vhostdomain1.tld
alias webmail.vhostdomain1.tld
alias admin.vhostdomain1.tld
alias autoconfig.vhostdomain1.tld
alias autodiscover.vhostdomain1.tld
port 443 namevhost vhostdomain2.tld (/etc/apache2/sites-enabled/vhostdomain2.tld.conf:62)
alias www.vhostdomain2.tld
alias webmail.vhostdomain2.tld
alias admin.vhostdomain2.tld
alias autoconfig.vhostdomain2.tld
alias autodiscover.vhostdomain2.tld
*:80 is a NameVirtualHost
default server antiochtechnologies.com (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost antiochtechnologies.com (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost antiochtech.com (/etc/apache2/sites-enabled/antiochtech.com.conf:1)
alias www.antiochtech.com
alias autoconfig.antiochtech.com
alias autodiscover.antiochtech.com
port 80 namevhost vhostdomain1.tld (/etc/apache2/sites-enabled/vhostdomain1.tld.conf:1)
alias www.vhostdomain1.tld
alias webmail.vhostdomain1.tld
alias admin.vhostdomain1.tld
alias autoconfig.vhostdomain1.tld
alias autodiscover.vhostdomain1.tld
port 80 namevhost vhostdomain2.tld (/etc/apache2/sites-enabled/vhostdomain2.tld.conf:1)
alias www.vhostdomain2.tld
alias webmail.vhostdomain2.tld
alias admin.vhostdomain2.tld
alias autoconfig.vhostdomain2.tld
alias autodiscover.vhostdomain2.tld
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex fcgid-proctbl: using_defaults
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex mpm-accept: using_defaults
Mutex fcgid-pipe: using_defaults
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: ENABLE_USR_LIB_CGI_BIN
User: name="www-data" id=33
Group: name="www-data" id=33
It's always bad having two or more vHosts with the same combination of port and ServerName.
You can define a ServerName like "localhost" as the ServerName of your default host.
If your definitions are not clear, the default vHost is used -> then a domain has the wrong certificate (the certificate of the default vHost). And sometimes wrong redirects (the "default redirects").
before i go ripping things apart that have worked for years, id just like to make sure that we’re all on the same page here. ur saying that changing my apache configuration will address issues im having with select email clients being able to retrieve their messages via imap?
Your https://www.antiochtechnologies.com/ has the wrong certificate. So if a user uses this domain with mail, the same wrong certificate may be send. If a configuration is buggy, this configuration may have some other bugs I don't know and I don't see. So things should work - but the system crashes.
thats what this whole topic is about - mail issues. there are no websites for any variation of antiochtechnologies.com on ports 80 or 443. the only site hosted on that domain is webmin’s built-in server. the issue is that quite suddenly select mail clients are getting a name mismatch error with whatever vhost come first alphabetically.
attempting to setup the mail account for a test user on my handset produces the following in mail.log after turning on verbose ssl logging in dovecot:
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: message repeated 6 times: [ imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [166.175.186.245]]
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: unknown state [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: unknown state [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Warning: SSL alert: where=0x4004, ret=558: fatal certificate unknown [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Warning: SSL failed: where=0x2002: unknown state [166.175.186.245]
May 3 13:00:26 lamp1 dovecot: imap-login: Error: SSL: Stacked error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46
May 3 13:00:26 lamp1 dovecot: imap-login: Debug: SSL error: SSL_accept() failed: Unknown error
May 3 13:00:26 lamp1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=166.175.186.245, lip=216.235.107.56, TLS handshaking: SSL_accept() failed: Unknown error, session=<NOl8hv+HC2Smr7r1>