if I enter where it says view certificate
issued for: imap.estudioines.com
issued by: Lets Encrypt Authority X3
Valid from: 23/11/2017 to 21/02/2018
that error also appears on other devices: iphone, ipad
if I enter where it says view certificate
issued for: imap.estudioines.com
issued by: Lets Encrypt Authority X3
Valid from: 23/11/2017 to 21/02/2018
that error also appears on other devices: iphone, ipad
Ah. I guess that means you access the imap server via a different domain name, but itâs using the same certificate. You seem to already have a valid certificate for the imap domain name (assuming itâs not literally mydomain.com
in the output from certbot certificates
) so you should probably just configure the imap server to use that instead of the smtp certificate.
EDIT: or rather, vice versa. Iâm tired. Itâs after 2am here you should probably configure the smtp server⌠etc. I should get some sleep lol
You could combine the domain names SMTP and IMAP on one cert and use that cert for both services.
Thanks for your time! Ok, then will try configure smtp, ut i dont have idea how
Mmmm, how do it? Never try to combine domain names,
Try:
certbot certonly -d smtp.mydomain --webroot-path /path/to/smtp/files -d imap.mydomain --webroot-path /path/to/imap/files
replace domains with your actual domains
replace /path/⌠with your actual paths
sorry for my ignorance, but what path are we talking about? I can not understand ⌠and I do not want to make everything work badly then
If your âcertonlyâ command succeeds, certbot gets a cert and changes nothing.
If your âcertonlyâ command fails, certbot gets nothing and changes nothing.
The paths would be as specified in the your âwebserverâ software.
Wherever the ârootâ path for each is located in your system.
Again, if you try and it fails nothing bad happens*
*=other than it logs that as a failed attemptâŚ
So you might want to âtryâ with --dry-run
or -staging
until you get the command and paths correct.
Sorry for delay,
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Select the appropriate number [1-3] then [enter] (press âcâ to cancel):2
Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org
Please enter in your domain name(s) (comma and/or space separated) (Enter 'câ
to cancel):imap.estudioines.com
Cert not due for renewal, but simulating renewal for dry run
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for imap.mydomain.com
Press 1 [enter] to confirm the selection (press âcâ to cancel): 1
Input the webroot for imap.mydomain.com: (Enter âcâ to cancel):???
Input the webroot for imap.mydomain.com: (Enter âcâ to cancel):c
Press 1 [enter] to confirm the selection (press âcâ to cancel): c
Cleaning up challenges
Every requested domain must have a webroot when using the webroot plugin.
Then:
Press 1 [enter] to confirm the selection (press âcâ to cancel): 1
Input the webroot for imap.mydomain.com: (Enter âcâ to cancel):/etc/letsencrypt/live/smtp.mydomain.com
Waiting for verificationâŚ
Cleaning up challenges
Failed authorization procedure. imap.mydomain.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://imap.estudioines.com/.well-known/acme-challenge/L7FOjBofI99-olKbdvHNpuJV27eCu0pVgoQOpeseC-4: "
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: imap.mydomain.com
Type: unauthorized
Detail: Invalid response from
http://imap.mydomain.com/.well-known/acme-challenge/L7FOjBofI99-ol09dfkjmdfl09V27eCu0pVgoQOpeseC-4:
"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
I do not understand why the webroot command.
The path /var/ www/html is empty, there are no configuration files. All certificates are renewed for 84 days and the Dovecot configuration (an extract from it) has the following:
ssl_cert = </etc/letsencrypt/live/imap.mydomain.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/imap.mydomain.com/privkey.pem
beyond that microsoft outlook and other mail applications for end users give the same error (for more all certificates, smtp, imap, mail ⌠are updated):
âThe server you are connected to is using a security certificate that can not verifyâ âthe target principal name is incorrectâ
Iâm pretty lost, you know excuse me. but the configuration of the server is in operation, the only thing we can not remove the error in the applications that send and receive mails. Times ago my co-worker has made the renovation in such a way that this does not happen.
If you need configuration files of postfix or dovecot or any other file tell me and I will expose here such configurations.
Neither of those are correct.
You need to give the location of the root folder for the site.
Start by finding which service is bound to port 80.
Then find the configuration files for that web service.
http://letsencrypt.readthedocs.io/en/latest/using.html#webroot
Ok,
#fuser -n tcp 80
80/tcp: 813 14648 14650 14651 14652 14653 14654 14767 16182 16183
/# ps x | grep 813
813 ? Ss 0:08 /usr/sbin/apache2 -k start
16625 pts/0 S+ 0:00 grep 813
path /var/www/html is empty, no conf file inside or other file
show:
/usr/sbin/apachectl -V
Server version: Apache/2.4.10 (Debian)
Server built: Jul 20 2016 07:07:13
Serverâs Module Magic Number: 20120211:37
Server loaded: APR 1.5.1, APR-UTIL 1.5.4
Compiled using: APR 1.5.1, APR-UTIL 1.5.4
Architecture: 32-bit
Server MPM: prefork
threaded: no
forked: yes (variable process count)
Server compiled withâŚ
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=256
-D HTTPD_ROOT="/etc/apache2"
-D SUEXEC_BIN="/usr/lib/apache2/suexec"
-D DEFAULT_PIDLOG="/var/run/apache2.pid"
-D DEFAULT_SCOREBOARD=âlogs/apache_runtime_statusâ
-D DEFAULT_ERRORLOG=âlogs/error_logâ
-D AP_TYPES_CONFIG_FILE=âmime.typesâ
-D SERVER_CONFIG_FILE=âapache2.confâ
Sorry te path no is empty, have inside index.html file
For other way:
/etc/apache2/sites-enabled# ls
000-default.conf default-ssl.conf
#cat default-ssl.conf
ServerAdmin webmaster@localhost DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the requestâs Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com
ServerAdmin webmaster@localhost
start by showing:
/etc/apache2/apache2.conf
cat apache2.conf
#ServerRoot â/etc/apache2â
Mutex file:${APACHE_LOCK_DIR} default
PidFile ${APACHE_PID_FILE}
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups Off
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
IncludeOptional mods-enabled/.load
IncludeOptional mods-enabled/.conf
Include ports.conf
<Directory /usr/share>
AllowOverride None
Require all granted
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
#<Directory /srv/>
#
AccessFileName .htaccess
<FilesMatch â^.htâ>
Require all denied
LogFormat â%v:%p %h %l %u %t â%râ %>s %O â%{Referer}iâ â%{User-Agent}iââ vhost_combined
LogFormat â%h %l %u %t â%râ %>s %O â%{Referer}iâ â%{User-Agent}iââ combined
LogFormat â%h %l %u %t â%râ %>s %Oâ common
LogFormat â%{Referer}i -> %Uâ referer
LogFormat â%{User-agent}iâ agent
IncludeOptional conf-enabled/*.conf
IncludeOptional sites-enabled/*.conf
OK.
show all of:
/etc/apache2/sites-enabled/000-default.conf
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the requestâs Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
/etc/apache2/sites-enabled/default-ssl.conf shows:
DocumentRoot /var/www/html
try
grep -i root /etc/apache2/sites-enabled/*
/etc/apache2/sites-enabled/000-default.conf: DocumentRoot /var/www/html
/etc/apache2/sites-enabled/analaura5.conf: DocumentRoot /var/www/analaura5/httpdocs/
/etc/apache2/sites-enabled/default-ssl.conf: DocumentRoot /var/www/html
OK there it is:
DocumentRoot /var/www/html
create the path and test file:
mkdir /var/www/html/.well-known
mkdir /var/www/html/.well-known/acme-challenge
echo test > /var/www/html/.well-known/acme-challenge/test.txt
then try accessing it from the outside:
http://your.sitename/.well-known/acme-challenge/test.txt
it seems that http is being redirected to httpsâŚ
So we need to ensure Apache is handling the HTTPS requests.
Try
netstat -pant | grep 443