<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div style="font-family: inherit; font-size: inherit; color: rgb(0, 0, 0);"><br>
</div>
<div>Hi Michael,</div>
<div><br>
</div>
<div>Followed your instructions and it works like a charm. Thank you!</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Blueonyx <blueonyx-bounces@mail.blueonyx.it> on behalf of Michael Stauber via Blueonyx <blueonyx@mail.blueonyx.it><br>
<b>Sent:</b> Sunday, 24 September 2023 18:33<br>
<b>To:</b> blueonyx@mail.blueonyx.it <blueonyx@mail.blueonyx.it><br>
<b>Subject:</b> [BlueOnyx:26514] Re: [EXTERNAL] Re: SSL error when receiving mail from GMAIL</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Arie,<br>
<br>
> Vsite web- and mailserver aliases are <a href="http://www.ceelie.info">www.ceelie.info</a>
<br>
> <<a href="http://www.ceelie.info">http://www.ceelie.info</a>>, ceelie.info and mail.ceelie.info.<br>
> I've selected those three in the LetsEncrypt! module.<br>
<br>
Very well. But why does ...<br>
<br>
<a href="https://www.ceelie.info/">https://www.ceelie.info/</a><br>
<a href="https://mail.ceelie.info/">https://mail.ceelie.info/</a><br>
<a href="https://ceelie.info/">https://ceelie.info/</a><br>
<br>
... bring up a webpage(s) with a self-signed certificate?<br>
<br>
See: <br>
<a href="https://www.ssllabs.com/ssltest/analyze.html?d=ceelie.info&hideResults=on&ignoreMismatch=on&latest">https://www.ssllabs.com/ssltest/analyze.html?d=ceelie.info&hideResults=on&ignoreMismatch=on&latest</a><br>
<br>
> As for the hosting DNS, these are the settings.<br>
<br>
Take a look at this: <a href="https://www.blueonyx.it/dns-for-email">https://www.blueonyx.it/dns-for-email</a><br>
<br>
The righthand side of the DNS MX records (where it points to) must the <br>
the FQDN of the Vsite as shown in the Vsite List.<br>
<br>
So in your case that should be "<a href="http://www.ceelie.info">www.ceelie.info</a>" and not just
<br>
"ceelie.info". The reason for this is how Sendmail/Postfix match the <br>
email aliases to local user accounts.<br>
<br>
Here is a third party site for checking TLS:<br>
<br>
<a href="https://www.checktls.com/">https://www.checktls.com/</a><br>
<br>
When I try it against a correctly configured 5210R or 5211R it checks <br>
out just fine.<br>
<br>
When I test it against admin@ceelie.info it errors out because you have <br>
a self-signed SSL certificate in your certificate chain:<br>
<br>
--------------------------------------------------------------<br>
-----END CERTIFICATE-----<br>
subject=C = NL, L = Leiden, O = Ceelie, CN = mail.ceelie.info, <br>
emailAddress = elpadre@ceelie.info<br>
issuer=C = NL, L = Leiden, O = Ceelie, CN = mail.ceelie.info, <br>
emailAddress = elpadre@ceelie.info<br>
---<br>
No client certificate CA names sent<br>
Peer signing digest: SHA256<br>
Peer signature type: RSA-PSS<br>
Server Temp Key: X25519, 253 bits<br>
---<br>
SSL handshake has read 2438 bytes and written 426 bytes<br>
Verification error: self-signed certificate<br>
---<br>
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384<br>
Server public key is 4096 bit<br>
Secure Renegotiation IS NOT supported<br>
Compression: NONE<br>
Expansion: NONE<br>
No ALPN negotiated<br>
Early data was not sent<br>
Verify return code: 18 (self-signed certificate) <--- !!!!!<br>
--------------------------------------------------------------<br>
<br>
Make sure the GUI of the BlueOnyx has a valid SSL certificate (Let's <br>
Encrypt or other), too. Because in an SNI environment the GUI cert is <br>
the first certificate in the SNI certificate chain.<br>
<br>
So I see three issues:<br>
<br>
- DNS best practices for BlueOnyx not followed<br>
- BlueOnyx GUI has no valid SSL certificate<br>
- Vsite itself seems to have a self-signed certificate<br>
<br>
> When trying ...<br>
><br>
> openssl s_client -starttls smtp -connect <servername>:<port><br>
><br>
> ... all three servernames/domains fail for port 25 and 587.<br>
> Port 443 gives a CONNECTED(00000003). Nothing more.<br>
<br>
Yes, because that OpenSSL client command has the option "-starttls smtp" <br>
for checking SMTP specifically.<br>
<br>
Use this to check the web based TLS:<br>
<br>
openssl s_client -connect <URL-or-IP>:443<br>
<br>
Or this to check the GUI HTTPS:<br>
<br>
openssl s_client -connect <URL-or-IP>:81<br>
<br>
I'm not sure what you're doing there, but either you're not supplying <br>
the correct information and the Vsite name is different than <br>
"<a href="http://www.ceelie.info">www.ceelie.info</a>" and/or you're not following the instructions and best
<br>
practices for BlueOnyx.<br>
<br>
If you want, contact me offlist and/or supply a "Support Request" via <br>
the GUI with "Allow access" ticked and I'll take a look directly at the <br>
server.<br>
<br>
-- <br>
With best regards<br>
<br>
Michael Stauber<br>
_______________________________________________<br>
Blueonyx mailing list<br>
Blueonyx@mail.blueonyx.it<br>
<a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><br>
</div>
</span></font></div>
</body>
</html>