1

This is a follow up to another question I had, but its quite different so I thought I'd start a new post.

Emails bouncing - 454 TLS not available due to temporary reason

I'm trying to work out why I still get this error message when adding an email account (in this case, in Thunderbird - but I also get the problem on phones as well);

enter image description here

The weird thing is that if I check it on SSL-Tools.net, it looks fine:

https://ssl-tools.net/mailservers/wkingbrickwork.co.uk

I really don't get it - as Thunderbird shows me my certificate is expired here:

enter image description here

Am I missing something? Please let me know if you need any more information to help me debug. I'm not sure what would be helpful.

  • Most probably you are missing the DST Root CA X3 certificate in Thunderbird. If you click on 'Get Certificate' and inspect it Thunderbird should show you why it deems the certificate invalid. – Gerald Schneider Aug 16 '17 at 9:00
  • @GeraldSchneider - thanks. This is an up-to-date version so should be fine for the root cert. The more confusing part is that I've just seen that MY certificate shows as expired on the 9th of Aug (see updated). Yet when I look at it here: admin.newbyhost.com , it shows as expiring on the 8th of October! Does the mail stuff look up the certificate in a different way? (and how can I test this) – Andrew Newby Aug 16 '17 at 9:03
  • It's possible that the mailserver is configured to use a different certificate file than the webserver. Or the mailserver hasn't been restarted after the cert file was renewed and is still using the old certificate from cache. – Gerald Schneider Aug 16 '17 at 9:05
  • Looking at the details of your cert on ssl-tools.net it seems that your mailserver is providing two certificates ... the valid and the invalid one. It should only provide the newer certificate. – Gerald Schneider Aug 16 '17 at 9:15
  • @GeraldSchneider interesting. I just rebooted the server, and it does seem to have gone away with that message. I'm not sure why though, as I'm rebooting exim4 and vesta (the control system). With regards to the duplicate certs - do you still see that? – Andrew Newby Aug 16 '17 at 9:19
4

Inspecting the certificate shows that the certificate has expired.

Since the webserver provides a valid certificate, it seems that the mail service hasn't been restarted after the certificate was renewed and is still serving the old certificate.

A restart of the mail service should fix the problem.

To prevent such problems in the future you can use the renew-hook of certbot with a simple shell script.

This is a script I am using:

#!/bin/bash
for domain in $RENEWED_DOMAINS
do
    if [ "$domain" = mail.example.com ]
    then
        /etc/init.d/dovecot reload >/dev/null
    elif [ "$domain" = intern.example.com ]
    then
        cp /etc/letsencrypt/live/$domain/* /etc/ldap/ssl/
        chown -R openldap:openldap /etc/ldap/ssl/
        chmod 640 /etc/ldap/ssl/*
        /etc/init.d/slapd force-reload >/dev/null
    else
        /etc/init.d/apache2 reload >/dev/null
    fi
done

The script is provided to certbot with the --renew-hook parameter in the cron job:

/opt/certbot-auto --renew-hook /opt/certbot-renew renew --quiet --no-self-upgrade

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.