Thunderbird vs. LetsEncrypt woes

Rocky Linux Help & Support
1

Hi,

I’m hosting my own mailserver using Postfix, Dovecot and OpenDKIM on Rocky Linux 8, for my own domain as well as a few others. That setup has been working perfectly for a few years now.

A few days ago, Thunderbird started complaining about LetsEncrypt certificates. On the server, the LetsEncrypt certificates are updated once a month via a cronjob, and then Postfix and Dovecot get restarted. This has always worked well.

Now my phone keeps ringing, because all folks who are using Thunderbird as a client for their mail hosted on my server keep getting the same message.

And I can’t figure out what’s going on. Is this a known problem ? Anybody get the same warnings and error messages ?

Cheers from the sunny South of France,

Niki

2

What are the warnings and errors you are getting? What’s in the log files when someone connects via Thunderbird be it IMAP/POP3 or SMTP? And what’s the error from the Thunderbird client itself?

3

I am having a similar problem. Seems to be a Thunderbird problem, perhaps because of the removal by LetsEncrypt of the client auth flag.

Send Message Error
Sending of the message failed.
Peer’s Certificate issuer is not recognized.
The configuration related to lig dot net must be corrected.

Looking at the certificate in Thunderbird: Everything seems fine. Can’t copy from that view, but valid dates, DNS name, etc. all look normal.

4

Right, here goes. Here’s what happens when I open Thunderbird with a series of accounts. These are the logs on the server:

Jun  8 14:04:29 sd-110196 dovecot[1786]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 (no auth attempts in 1 secs): user=<>, rip=86.193.248.219, lip=163.172.82.215, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<qtoB0LxTEKBWwfjb>
Jun  8 14:04:29 sd-110196 dovecot[1786]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 (no auth attempts in 1 secs): user=<>, rip=86.193.248.219, lip=163.172.82.215, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<iwkC0LxTFKBWwfjb>
Jun  8 14:04:29 sd-110196 dovecot[1786]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 (no auth attempts in 1 secs): user=<>, rip=86.193.248.219, lip=163.172.82.215, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<iikC0LxTHKBWwfjb>

I’m clueless.

5

Unknown certificate authority error

6

OK, I found the problem. Looks like LetsEncrypt has been handling certificates differently indeed in the very recent pas.

Here’s the relevant fragment of my /etc/postfix/main.cf file :

smtpd_tls_cert_file = /etc/letsencrypt/live/sd-110196.dedibox.fr/cert.pem
smtpd_tls_key_file = /etc/letsencrypt/live/sd-110196.dedibox.fr/privkey.pem

And here’s /etc/dovecot/conf.d/10-ssl.conf :

ssl_cert = </etc/letsencrypt/live/sd-110196.dedibox.fr/cert.pem
ssl_key = </etc/letsencrypt/live/sd-110196.dedibox.fr/privkey.pem

On a whim I replaced cert.pem by fullchain.pem in both files. Here’s Postfix :

smtpd_tls_cert_file = /etc/letsencrypt/live/sd-110196.dedibox.fr/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/sd-110196.dedibox.fr/privkey.pem

And here’s Dovecot :

ssl_cert = </etc/letsencrypt/live/sd-110196.dedibox.fr/fullchain.pem
ssl_key = </etc/letsencrypt/live/sd-110196.dedibox.fr/privkey.pem

I restarted Postfix and Dovecot and everything works perfectly now.