I am at a last resort :(

I have an Amazon EC2 instance that I run my mail server from.

My mail server is setup with ubuntu server 14.04, postfix, dovecot and has been running fine for years however I cannot get a comodo certificate to work with it.

My telnet says

Trying IP.IP.IP.IP...
Connected to mail.example.com.
Escape character is '^]'.
220 mail.example.com ESMTP
501 Syntax: EHLO hostname
ehlo mail.example.com
250-SIZE 104857600
250 DSN
454 4.7.0 TLS not available due to local problem
421 4.4.2 mail.example.com Error: timeout exceeded
Connection closed by foreign host.

I have searched this error and tried various things like testing the certificates and key and they are all correct including the bundle.crt

I initially tried to replace the certificate with startcom and trying to fix things ended up with serious DNS issues which I have now rectified and I am sure that this is now something to do with the certificate and/or key.

I even spun up a new instance and started again from scratch building my server

dovecot -n returns

# 2.2.18: /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.8 (0c4ae064f307+)
# OS: Linux 3.13.0-95-generic x86_64 Ubuntu 14.04.5 LTS ext4
auth_mechanisms = plain login
auth_verbose = yes
mail_home = /var/mail/vmail/%d/%n
mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-            character vacation subaddress comparator-i;ascii-numeric relational regex     imap4flags copy include variables body enotify environment mailbox date     index ihave duplicate
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  mailbox "Sent Messages" {
    auto = subscribe
    special_use = \Sent
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  prefix = 
passdb {
  args = username_format=%u scheme=ssha512 /etc/dovecot/passwd.db
  driver = passwd-file
plugin {
  sieve = ~/.dovecot.sieve
  sieve_after = /var/mail/vmail/sieve-after
  sieve_before = /var/mail/vmail/sieve-before
  sieve_dir = ~/sieve
protocols = imap sieve
service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0660
    user = postfix
ssl_cert = </etc/ssl/private/ssl-bundle.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_key = </etc/ssl/private/mailserver.key
userdb {
  args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n
  driver = static
protocol lda {
  deliver_log_format = msgid=%m: %$
  mail_plugins = sieve
  postmaster_address = postmaster@example.com
  quota_full_tempfail = yes
  rejection_reason = Your message to <%t> was automatically         rejected:%n%r
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
  mail_max_userip_connections = 10

However /var/log/upstart/dovecot.log shows

doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-    ssl.conf line 12: ssl_cert: Can't open file /etc/dovecot/dovecot.pem: No     such file or directory


doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/99-    mail-stack-delivery.conf line 4: ssl_cert: Can't open file     /etc/ssl/private/ca-bundle.crt: No

The files are in /etc/ssl/private with permissions 400

And I have checked syntax in my config files.

I'm not even using "/etc/dovecot/conf.d/10-ssl.conf" and all lines are commented out.

I am sure I am missing a vital step which is driving me round the bend and has been for a week.

These are the files in my /etc/ssl/private folder

AddTrustExternalCARoot.crt                   ssl-bundle2.crt
COMODORSAAddTrustCA.crt                      ssl-bundle.crt
COMODORSADomainValidationSecureServerCA.crt  ssl-bundle.pem
mail_example_com.crt               ssl-cert-snakeoil.key

openssl s_client -connect mail.example.com: 25 -starttls smtp -CApath /etc/ssl/certs gives..

140077443561120:error:140770FC:SSL     routines:SSL23_GET_SERVER_HELLO:unknown     protocol:s23_clnt.c:795:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 235 bytes and     written 330 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

Any pointers would be great :)

Thank you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.