I am at a last resort :(

I have an Amazon EC2 instance that I run my mail server from.

My mail server is setup with ubuntu server 14.04, postfix, dovecot and has been running fine for years however I cannot get a comodo certificate to work with it.

My telnet says

Trying IP.IP.IP.IP...
Connected to mail.example.com.
Escape character is '^]'.
220 mail.example.com ESMTP
501 Syntax: EHLO hostname
ehlo mail.example.com
250-SIZE 104857600
250 DSN
454 4.7.0 TLS not available due to local problem
421 4.4.2 mail.example.com Error: timeout exceeded
Connection closed by foreign host.

I have searched this error and tried various things like testing the certificates and key and they are all correct including the bundle.crt

I initially tried to replace the certificate with startcom and trying to fix things ended up with serious DNS issues which I have now rectified and I am sure that this is now something to do with the certificate and/or key.

I even spun up a new instance and started again from scratch building my server

dovecot -n returns

# 2.2.18: /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.8 (0c4ae064f307+)
# OS: Linux 3.13.0-95-generic x86_64 Ubuntu 14.04.5 LTS ext4
auth_mechanisms = plain login
auth_verbose = yes
mail_home = /var/mail/vmail/%d/%n
mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-            character vacation subaddress comparator-i;ascii-numeric relational regex     imap4flags copy include variables body enotify environment mailbox date     index ihave duplicate
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  mailbox "Sent Messages" {
    auto = subscribe
    special_use = \Sent
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  prefix = 
passdb {
  args = username_format=%u scheme=ssha512 /etc/dovecot/passwd.db
  driver = passwd-file
plugin {
  sieve = ~/.dovecot.sieve
  sieve_after = /var/mail/vmail/sieve-after
  sieve_before = /var/mail/vmail/sieve-before
  sieve_dir = ~/sieve
protocols = imap sieve
service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0660
    user = postfix
ssl_cert = </etc/ssl/private/ssl-bundle.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_key = </etc/ssl/private/mailserver.key
userdb {
  args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n
  driver = static
protocol lda {
  deliver_log_format = msgid=%m: %$
  mail_plugins = sieve
  postmaster_address = postmaster@example.com
  quota_full_tempfail = yes
  rejection_reason = Your message to <%t> was automatically         rejected:%n%r
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
  mail_max_userip_connections = 10

However /var/log/upstart/dovecot.log shows

doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-    ssl.conf line 12: ssl_cert: Can't open file /etc/dovecot/dovecot.pem: No     such file or directory


doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/99-    mail-stack-delivery.conf line 4: ssl_cert: Can't open file     /etc/ssl/private/ca-bundle.crt: No

The files are in /etc/ssl/private with permissions 400

And I have checked syntax in my config files.

I'm not even using "/etc/dovecot/conf.d/10-ssl.conf" and all lines are commented out.

I am sure I am missing a vital step which is driving me round the bend and has been for a week.

These are the files in my /etc/ssl/private folder

AddTrustExternalCARoot.crt                   ssl-bundle2.crt
COMODORSAAddTrustCA.crt                      ssl-bundle.crt
COMODORSADomainValidationSecureServerCA.crt  ssl-bundle.pem
mail_example_com.crt               ssl-cert-snakeoil.key

openssl s_client -connect mail.example.com: 25 -starttls smtp -CApath /etc/ssl/certs gives..

140077443561120:error:140770FC:SSL     routines:SSL23_GET_SERVER_HELLO:unknown     protocol:s23_clnt.c:795:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 235 bytes and     written 330 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

Any pointers would be great :)

Thank you

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.