3

I am at a last resort :(

I have an Amazon EC2 instance that I run my mail server from.

My mail server is setup with ubuntu server 14.04, postfix, dovecot and has been running fine for years however I cannot get a comodo certificate to work with it.

My telnet says

Trying IP.IP.IP.IP...
Connected to mail.example.com.
Escape character is '^]'.
220 mail.example.com ESMTP
ehlo
501 Syntax: EHLO hostname
ehlo mail.example.com
250-mail.example.com
250-PIPELINING
250-SIZE 104857600
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
starttls
454 4.7.0 TLS not available due to local problem
421 4.4.2 mail.example.com Error: timeout exceeded
Connection closed by foreign host.

I have searched this error and tried various things like testing the certificates and key and they are all correct including the bundle.crt

I initially tried to replace the certificate with startcom and trying to fix things ended up with serious DNS issues which I have now rectified and I am sure that this is now something to do with the certificate and/or key.

I even spun up a new instance and started again from scratch building my server

dovecot -n returns

# 2.2.18: /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.8 (0c4ae064f307+)
# OS: Linux 3.13.0-95-generic x86_64 Ubuntu 14.04.5 LTS ext4
auth_mechanisms = plain login
auth_verbose = yes
mail_home = /var/mail/vmail/%d/%n
mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-            character vacation subaddress comparator-i;ascii-numeric relational regex     imap4flags copy include variables body enotify environment mailbox date     index ihave duplicate
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    auto = subscribe
    special_use = \Sent
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = username_format=%u scheme=ssha512 /etc/dovecot/passwd.db
  driver = passwd-file
}
plugin {
  sieve = ~/.dovecot.sieve
  sieve_after = /var/mail/vmail/sieve-after
  sieve_before = /var/mail/vmail/sieve-before
  sieve_dir = ~/sieve
}
protocols = imap sieve
service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
ssl_cert = </etc/ssl/private/ssl-bundle.pem
ssl_cipher_list =     ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:D    H+3DES:RSA+AES:RSA+3DES:!ADH:!AECDH:!MD5:!DSS
ssl_client_ca_dir = /etc/ssl/certs
ssl_key = </etc/ssl/private/mailserver.key
userdb {
  args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n
  driver = static
}
protocol lda {
  deliver_log_format = msgid=%m: %$
  mail_plugins = sieve
  postmaster_address = postmaster@example.com
  quota_full_tempfail = yes
  rejection_reason = Your message to <%t> was automatically         rejected:%n%r
}
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
  mail_max_userip_connections = 10
}

However /var/log/upstart/dovecot.log shows

doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-    ssl.conf line 12: ssl_cert: Can't open file /etc/dovecot/dovecot.pem: No     such file or directory

And

doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/99-    mail-stack-delivery.conf line 4: ssl_cert: Can't open file     /etc/ssl/private/ca-bundle.crt: No

The files are in /etc/ssl/private with permissions 400

And I have checked syntax in my config files.

I'm not even using "/etc/dovecot/conf.d/10-ssl.conf" and all lines are commented out.

I am sure I am missing a vital step which is driving me round the bend and has been for a week.

These are the files in my /etc/ssl/private folder

AddTrustExternalCARoot.crt                   ssl-bundle2.crt
COMODORSAAddTrustCA.crt                      ssl-bundle.crt
COMODORSADomainValidationSecureServerCA.crt  ssl-bundle.pem
mail_example_com.crt               ssl-cert-snakeoil.key
mailserver.key

openssl s_client -connect mail.example.com: 25 -starttls smtp -CApath /etc/ssl/certs gives..

CONNECTED(00000003)
140077443561120:error:140770FC:SSL     routines:SSL23_GET_SERVER_HELLO:unknown     protocol:s23_clnt.c:795:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 235 bytes and     written 330 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

Any pointers would be great :)

Thank you

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.