1

This is a follow up to another question I had, but its quite different so I thought I'd start a new post.

Emails bouncing - 454 TLS not available due to temporary reason

I'm trying to work out why I still get this error message when adding an email account (in this case, in Thunderbird - but I also get the problem on phones as well);

enter image description here

The weird thing is that if I check it on SSL-Tools.net, it looks fine:

https://ssl-tools.net/mailservers/wkingbrickwork.co.uk

I really don't get it - as Thunderbird shows me my certificate is expired here:

enter image description here

Am I missing something? Please let me know if you need any more information to help me debug. I'm not sure what would be helpful.

Improve this question
10
  • Most probably you are missing the DST Root CA X3 certificate in Thunderbird. If you click on 'Get Certificate' and inspect it Thunderbird should show you why it deems the certificate invalid.
    – Gerald Schneider
    Aug 16, 2017 at 9:00
  • @GeraldSchneider - thanks. This is an up-to-date version so should be fine for the root cert. The more confusing part is that I've just seen that MY certificate shows as expired on the 9th of Aug (see updated). Yet when I look at it here: admin.newbyhost.com , it shows as expiring on the 8th of October! Does the mail stuff look up the certificate in a different way? (and how can I test this)
    – Andrew Newby
    Aug 16, 2017 at 9:03
  • It's possible that the mailserver is configured to use a different certificate file than the webserver. Or the mailserver hasn't been restarted after the cert file was renewed and is still using the old certificate from cache.
    – Gerald Schneider
    Aug 16, 2017 at 9:05
  • Looking at the details of your cert on ssl-tools.net it seems that your mailserver is providing two certificates ... the valid and the invalid one. It should only provide the newer certificate.
    – Gerald Schneider
    Aug 16, 2017 at 9:15
  • @GeraldSchneider interesting. I just rebooted the server, and it does seem to have gone away with that message. I'm not sure why though, as I'm rebooting exim4 and vesta (the control system). With regards to the duplicate certs - do you still see that?
    – Andrew Newby
    Aug 16, 2017 at 9:19

1 Answer 1

Reset to default
6

Inspecting the certificate shows that the certificate has expired.

Since the webserver provides a valid certificate, it seems that the mail service hasn't been restarted after the certificate was renewed and is still serving the old certificate.

A restart of the mail service should fix the problem.

To prevent such problems in the future you can use the deploy-hook of certbot with a simple shell script.

This is a script I am using:

#!/bin/bash
for domain in $RENEWED_DOMAINS
do
    if [ "$domain" = mail.example.com ]
    then
        systemctl reload dovecot
        systemctl reload postfix
    elif [ "$domain" = intern.example.com ]
    then
        cp /etc/letsencrypt/live/$domain/* /etc/ldap/ssl/
        chown -R openldap:openldap /etc/ldap/ssl/
        chmod 640 /etc/ldap/ssl/*
        systemctl reload slapd
    else
        systemctl reload apache2
    fi
done

The script is provided to certbot with the --deploy-hook parameter in the cron job:

/opt/certbot-auto --deploy-hook /opt/certbot-renew renew --quiet --no-self-upgrade
Improve this answer
2
  • Related: what should one do when a self-signed e-mail server certificate is about to expire?
    – Overmind
    Oct 2, 2020 at 11:57
  • FYI, certbot supports multiple hooks and hooks can be configured per certificate so in this example, only the openldap certificate needs a script, the rest could all be hooks.
    – Ginnungagap
    Oct 24, 2023 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .