Let's Encrypt - SSL certificate untrusted by mail client

**Delta04** · Feb 15th 2017

Hello, everyone.

This morning, by checking email (with Thunderbird, Mail client in iOS) I notice a warning that inform me that the Let's encrypt SSL is untrusted.
I disable/enable SSL for services on that domain, hopefuly it will renew, but no effect. This happened over night.

On https (web) all green, no problem.

Info:
Ubuntu 14.04 LTS
i-mscp 1.3.16
Let's encrypt 2.0.5

Not sure if it's a bug, a problem with let's encrypt servers or something else. Is there anyone that encounter this problem?

Thanks

**Nuxwin** · Feb 15th 2017

@Delta04

We cannot help you without more details.

Quote from Delta04

This morning, by checking email (with Thunderbird, Mail client in iOS) I notice a warning that inform me that the Let's encrypt SSL is untrusted.

SMTP or IMAP ?

Also

Be sure to configure your mail client with the name used in your cert.
Give use the domain name used in the cert if you want make us able to process some tests.

BTW: LetsEncrypt is a plugin and we have a specific section for plugins. Thread moved.

**Delta04** · Feb 15th 2017

Quote from Nuxwin

@Delta04

We cannot help you without more details.

SMTP or IMAP ?
Also

Be sure to configure your mail client with the name used in your cert.

Give use the domain name used in the cert if you want make us able to process some tests.

BTW: LetsEncrypt is a plugin and we have a specific section for plugins...

Thread moved.

Display More

Both, SMTP & IMAP.

I did configure the mail client with the domain name used in cert.

Domain is serverhost.ro and mail.fresco.ro (website is hosted by other hosting provider).

**Nuxwin** · Feb 15th 2017

Quote from Delta04

Domain is serverhost.ro and mail.fresco.ro (website is hosted by other hosting provider).

Please give us the expected info. You said: "I did configure the mail client with the domain name used in cert."

So:

Which domain exactly? serverhost.ro or mail.fresco.ro ?
The certificate has been generated for serverhost.ro or mail.fresco.ro ?
The certificate has been generated from where exactly? Which interface?
Output of: openssl x509 -noout -text -in /etc/imscp/imscp_services.pem?

**Delta04** · Feb 15th 2017

Fresco and serverhost are two different servers. I use serverhost and the problem appeared. Fresco, a client he notice also this problem...

Code

root@csrv30:~# openssl x509 -noout -text -in /etc/imscp/imscp_services.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
03:84:14:a7:19:b5:bc:cb:04:de:17:de:34:b4:f5:65:e7:4c
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Validity
Not Before: Feb 15 05:53:00 2017 GMT
Not After : May 16 05:53:00 2017 GMT
Subject: CN=csrv30.serverhost.ro
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:9d:2b:ae:fe:37:30:b5:9d:6d:7f:94:c3:9e:27:
d2:d8:5f:10:06:56:59:f8:46:2d:27:d7:2a:28:59:
4c:60:81:bf:5a:4f:f8:7f:f8:7b:38:67:35:fa:fc:
37:5b:2b:1f:cc:6d:7f:8e:28:0b:1c:4b:7f:ec:de:
b1:eb:3c:25:62:f5:2e:bf:75:d2:59:86:d4:e5:88:
07:8e:a3:b5:e1:db:cd:8b:55:f0:1b:4f:21:bc:6f:
3c:4d:3e:40:ef:69:72:9f:17:60:75:b5:eb:e3:20:
e6:25:a9:d5:f3:3c:af:eb:31:dd:a5:b6:40:4e:e7:
7e:00:07:26:ce:57:ac:1a:4c:40:19:a4:be:ae:cb:
b1:59:33:e2:0c:45:be:0a:8c:16:2b:2e:1a:9b:0e:
40:2b:13:56:a3:02:d3:b7:03:cf:0f:86:a3:2c:ce:
d3:ef:56:96:8f:06:47:fd:b1:8e:78:85:5b:e6:43:
3b:88:27:95:f5:82:ae:fd:25:96:59:0d:46:98:ef:
c9:fa:bf:e7:7f:a4:4b:36:a3:17:2e:f6:2e:fc:43:
61:e7:a7:b9:1e:7e:91:99:7b:48:31:ee:d2:b2:49:
e7:2f:cf:7c:ab:69:cd:db:1e:0d:4d:35:da:91:3c:
03:e5:0c:8d:1c:50:8b:97:88:06:06:fe:90:10:af:
b2:b1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
55:63:BF:B1:33:8E:7B:DC:B2:E0:6F:8D:F5:41:59:EA:9B:FD:D1:D6
X509v3 Authority Key Identifier:
keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1
Authority Information Access:
OCSP - URI:http://ocsp.int-x3.letsencrypt.org/
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
X509v3 Subject Alternative Name:
DNS:csrv30.serverhost.ro
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
CPS: http://cps.letsencrypt.org
User Notice:
Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https://letsencrypt.org/repository/
Signature Algorithm: sha256WithRSAEncryption
39:e8:ae:f4:f1:f2:f2:7e:c3:d5:a3:86:24:3d:dd:49:64:e8:
6d:97:2b:09:48:68:90:dd:05:a2:2f:f4:09:bd:1b:ae:ba:e9:
3c:c7:db:56:ef:ca:3e:82:85:39:7e:01:25:70:c9:3e:2b:98:
06:fb:f9:d2:d5:6d:29:0a:b1:70:f2:3a:e2:23:10:06:bd:d9:
10:67:53:45:17:b5:59:39:a6:95:d4:39:9e:08:e3:0c:97:56:
99:a8:59:20:df:d2:b1:92:01:34:3a:2d:07:ab:6c:9d:eb:44:
41:3a:83:31:45:c6:81:11:51:1b:f6:18:80:1c:a7:1e:27:88:
19:29:32:d9:c5:5e:c6:46:2d:f1:a2:f1:4b:d3:80:3f:d5:5f:
6f:36:5a:3b:12:59:8a:97:65:ce:6d:9b:24:24:8c:59:67:23:
c2:3b:17:96:41:88:d2:b5:9c:11:6e:0d:e2:15:ba:51:92:aa:
49:71:ca:08:ca:e5:e5:2b:ea:27:a4:60:5a:ec:5a:11:3f:73:
bf:e2:98:cc:bd:60:02:53:b3:41:a5:87:2b:85:37:dd:2a:4e:
e2:90:c4:d9:61:8a:e5:d2:3a:80:61:eb:57:02:f1:22:b7:f5:
46:14:c7:d0:20:6b:82:58:17:3e:17:f8:2d:5a:58:c2:6d:07:
14:1d:eb:f4

Display More

**Nuxwin** · Feb 15th 2017

@Delta04

Please use csrv30.serverhost.ro in your mail client for smtp and imap.

**Delta04** · Feb 15th 2017

I did that. All worked fine.

Thanks for help.

**Nuxwin** · Feb 15th 2017

@Delta04

You're welcome.
Thread closed.

**Nuxwin** · Feb 15th 2017

For readers, see also: Mail Client und Zertifikate (specially Mail Client und Zertifikate)

Let's Encrypt - SSL certificate untrusted by mail client

Share

Daily visitors