yesterday I set ssl certificates for our company webpage and webmail client using Let's Encrypt Authority. After the succsses of this procedure I've tried to add the same certificate inside the postfix. Everything was okay and now CheckTLS Confidence get me 100% for TLC, CERT and so on. The only problem is now that the phone gmail app and other email client apps wont connect to smtp.
The error from /var/log/mail.log is
postfix/smtpd: Anonymous TLS connection established from unknown[18.104.22.168]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) postfix/smtpd: warning: SASL authentication failure: Password verification failed postfix/smtpd: warning: unknown[22.214.171.124]: SASL PLAIN authentication failed: authentication failure
The main thing that change except adding TLC cert is the MX record. Before was only mail, now is webmail because the domain of the cert was already registered to webmail.mysite.com. I rewrite the MX and A records bouth on the server and control panel inside domain hosting company. As I sayed the cert works and mail is encrypted using tlc cert, but the smpt connection inside the mobile app client failed. Server is Debian 8.11 postfix + cyrus + sasl. Mail accounts are created as linux users and then add to cyradm. So the password is shared between the OS and the mail box.
Spets I done so far to add TLS
smtpd_sasl_type=cyrus smtpd_sasl_path=private/auth smtpd_use_tls=yes smtpd_tls_ask_ccert=yes smtp_tls_security_level=may smtpd_tls_security_level=may smtp_tls_note_starttls_offer=yes smtpd_tls_received_header=yes myhostname = webmail.mysite.com #before was mail.mysite.com destination = mysite.com, webmail, webmail.mysite.com, localhost.localdomain, localhost before was mysite.com, mail, mail.mysite.com localhost.localdomain, localhost smtpd_tls_cert_file=/etc/letsencrypt/live/webmail.mysite.com/fullchain.pem smtpd_tls_key_file=/etc/letsencrypt/live/webmail.mysite.com/privkey.pem smtpd_tls_CAfile=/etc/letsencrypt/live/webmail.mysite.com/cert.pem
In /etc/postfix/master.cf delete the “#” sign from smtps and the next two columns
- In /etc/mailname change mail.mysite.com. to webmail.mysite.com.
- Uncommend imaps from /etc/cyrus.conf
Other info that maybe needed to help
cat /etc/postfix/sasl/smtpd.conf pwcheck_method: saslauthd mech_list: PLAIN LOGIN
allowplaintext: yes sasl_mech_list: PLAIN LOGIN sasl_minimum_layer: 1 # before this line was commend tls_cert_file: /etc/letsencrypt/live/webmail.mysite.com/fullchain.pem tls_key_file: /etc/letsencrypt/live/webmail.mysite.com/privkey.pem tls_ca_file: /etc/letsencrypt/live/webmail.mysite.com/cert.pem
The thing that I've tried so far also was to stop apache service and try connecting again. I've been thinking that domain name of the web based mail client and MX record are in conflict but no the error still exist. All ports are opened and redirectected correctly - 25, 143, 465, 993 I'm not a system administrator. I've start doing this to learn new stuff and because that's stuffs are interesting to me. So I've know that I don't know a lot of things but there are a lot of informations around the internet, people that can help and think I can handle this with your advices ^_^
Shortly ... the main questions are 1 Is the name of the MX record in conflict with the name of the http website if they are the same - webmail.mysite.com? At this ip/address there is a web-based mail client and a postfix. 2. Can postfix + cyrus + sals + tlc play together ? 3. We have mail boxes with account already working after enable tls for imap/smtp is there any other settings or need of renew all the users passwords.