I run a small web and email server: Debian 10.4 Apache 2.4.38-3+deb10u3 Postfix 3.4.10-0+deb10u1 Dovecot 2.3.4.1-5+deb10u2 The server hosts some domains. I use the certbot to create and renew the certificates. Apache, Postfix and Dovecot are configured to use the certificates in /etc/letsencr…

Perhaps you’ll need to run postmap -F hash:/etc/postfix/sni after a renewal?

[image] eehmke: I replaced some subdomains by xxx etc. You know Let's Encrypt certificates are submitted to certificate logs on issuance, right? :wink: In any case, I don't see any reason why Postfix shouldn't use your most recent certificate. What do the Postfix logs say when you do a post…

Just Jul 9 17:03:37 eehmke postfix/postfix-script[13718]: refreshing the Postfix mail system Jul 9 17:03:37 eehmke postfix/master[10404]: reload -- version 3.4.10, configuration /etc/postfix No errors.

And openssl x509 -noout -text </etc/letsencrypt/live/www.eehmke.de/fullchain.pem really, actually, to be 200 % sure, shows the most recent certificate, right? I’m pretty much at a loss why Postfix isn’t using the correct file :pensive:

[image] Osiris: openssl x509 -noout -text </etc/letsencrypt/live/www.eehmke.de/fullchain.pem # openssl x509 -noout -text </etc/letsencrypt/live/www.eehmke.de/fullchain.pem Certificate: Data: Version: 3 (0x2) Serial Number: 03:c3:09:83:b1:5c:87:ee:1d:1a:8f:e2:18…

Hi @eehmke [image] eehmke: My domain is: eehmke.de I ran this command: openssl s_client -connect mail.eehmke.de:465 checking your domain you see the problem - https://check-your-website.server-daten.de/?q=eehmke.de#connections Your main domain [2020-07-09.eehmke.de] mail server (port…

Hmm, the certificate is created for the main domain and all subdomains. How would there appear to be two mail servers? There are two vhosts indeed, for another domain.

Hm, indeed! When I change -servername mail.eehmke.de to -servername foo.eehmke.de or just eehmke.de, Postfix reports the correct certificate! I didn’t even know Postfix supported virtualhosts for TLS? And why doesn’t postconf show multiple smtpd_tls_chain_files configuration options? :frowning: Ah…

There is this line in main.cf: tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map That file contains the line: mail.eehmke.de /etc/letsencrypt/live/www.eehmke.de/privkey.pem /etc/letsencrypt/live/www.eehmke.de/fullchain.pem and the certificates for other domains.

I’m assuming the vmail_ssl.map has the correct spacing et cetera (probably removed by using the quote feature in stead of backticks). Still at a loss here, sorry. Could it be that the certificate is somehow cached by using this hash table? And it’s a really, really good and sturdy cache unfortunate…

I followed this guide when I set up the vmail_ssl.map: https://technikfreak.net/tipps-tricks/postfix-3-4-lets-encrypt-und-server-name-indication-sni/

Renewed certificate reported as expired

Help

eehmke July 9, 2020, 3:50pm 19

The hash only caches the names of the certificates, which have not changed

Topic		Replies	Views
Postfix issues with expired certificate on port 465 Help	13	471	March 17, 2025
Outlook stopped recognizing LetsEncrypt Cert after renew Help	32	3208	January 24, 2023
Letsencryptt Renew fail on main domain Help	24	2548	February 7, 2021
Renew certificate for mail Help	59	11802	January 7, 2018
Cert renewal successful for web server applications but not for mail server (postfix) Help	6	1429	August 9, 2021

Renewed certificate reported as expired

Related topics