Topic: Thunderbird rejects certificate - mail services serving .local cert instead Lets

[David]

I've set up SME Server 11 on a VM. The system was registered with the hostname tecnoconsulenza.local, and I later added dave.it as an additional domain. I created a user account with the corresponding password, and generated Let's Encrypt certificates through the server manager for dave.it (they show as valid and correctly issued).
The problem is with Thunderbird: when I try to configure the mail account (IMAP/SMTP) on dave.it, it reports the certificate as invalid. Checking the certificate details, Thunderbird is receiving the self-signed tecnoconsulenza.local certificate instead of the Let's Encrypt one for dave.it.
What I'd like to check?
Any guidance on how domain-based certificate selection works for mail services on a multi-domain SME Server 11 setup would be appreciated.
Thanks
David

[Jean-Philippe Pialasse]

let's encrypt can not do certificate for domains non routable to the internet.

.local is a no go.

your certificate not propagated to services means probably it failed.

dave.it currently points to a nginx server so clearly let's encrypt has no way to validate the certificate with http ports not pointing to the SME SERVER.   
So you still only have a self signed certificate for those two reasons.


the certificate panel shows the current used certificate.  it does not mean it is a let's encrypt certificate. 


what is your server configuration (server only or gateway)
tell us more about the networking around your server : direct access to internet, firewall...

[Stefano]

ok
I step in to describe david's infra
he has a 1 static ip connection.
Firewall forwards 80 and 443 ports to a reverse proxy (skudonet) and the mail related ports to SME
behind Skudonet there are some servers which serve web applications.. those applications can't be moved to SME
SME will act only as mail server
on the Skudonet, mail.dave.it is proxed (only for port 80) and SME is the backend.
so, here are my question:
1) is there any documentation for the new letsencrypt panel in the wiki? we searched but found none
2) is the new panel a web frontend for the cli commands? if so, can we just follow the instructions we find here https://wiki.koozali.org/Letsencrypt?
3) if the previous answer is no, how can we manage letsencrypt via cli?
4) how can we manage letsencrypt generation via DNS-01 challenge?
5) would a forward, on skudonet, of mail.dave.it/.well-known/acme-challenge/ path to SME work?

TIA

[Stefano]

other question:
I see that /etc/dovecot/ssl/imapd.pem and /etc/postfix/ssl/postfix.pem are the same file but they differ from the chain.pem
supposing to use SKudonet to generate the certs I need and to use them on SME, would it be enough to copy them on SMe, setting the correct path via modSSL keys?
which command should I issue after that?
will the imapd and postfix pem files reflect my setup?
TIA

[Jean-Philippe Pialasse]

you simply can not use let's encrypt without port 80 and port 443 pointing to sme server.

[Stefano]

you simply can not use let's encrypt without port 80 and port 443 pointing to sme server.

yes, I understood.. so I will let skudonet create the cert and then pull it from SME
disabling letsencrypt and using modSSL setup work as expected.
do I need both smeserver-certificate-update and email-update events or just the latter?
thank you

[Jean-Philippe Pialasse]

other question:
I see that /etc/dovecot/ssl/imapd.pem and /etc/postfix/ssl/postfix.pem are the same file but they differ from the chain.pem
supposing to use SKudonet to generate the certs I need and to use them on SME, would it be enough to copy them on SMe, setting the correct path via modSSL keys?
which command should I issue after that?
will the imapd and postfix pem files reflect my setup?
TIA

if port 80 and port 443 can not be redirected to the sme you arr left with two choices

- nfs the web server .well-known/acme-challenge directory to sme's /var/www/html/.well-known/acme-challenge/
sshfs is also a good way to do that.

- as you described generate and scp the certs from another front machine. you need to upload 3 files : key, cert and intermediate chain.
do not upload them in the /home/e-smtih/ssl* existing folder they will be overwritten by self signed certs.
after upload set the 3 modSSL Properties with their path.  then execute the ssl-update signal.


you will need to automate this as it needs to be renewed every 3 months.