TLS certificate for sendmail - Revision history

Joosteto: /* Sendmail file permissions */

2021-11-11T19:59:41Z

Sendmail file permissions

2021-07-13T16:17:32Z

2021-03-15T13:58:39Z

2020-10-13T21:31:21Z

dhparams file

2020-10-13T21:30:58Z

2020-10-13T21:10:34Z

dhparam file

2020-04-18T10:17:19Z

2020-04-18T10:09:46Z

2020-04-18T08:41:33Z

2020-04-18T08:33:53Z

@@ Line 53: / Line 53: @@
 certbot stores all cert files with group/other read permission. This is OK, as they are in a directory that only has owner-access, but sendmail still doesn't trust it, and fails to load the cert files. Currently I'm trying to fix this with:
- cat /lib/systemd/system/certbot.service
+ cat /etc/systemd/system/certbot.service
  [Unit]
@@ Line 62: / Line 62: @@
  Type=oneshot
  ExecStartPre=/usr/bin/certbot -q renew
- ExecStart=/bin/chmod og-r /etc/letsencrypt/archive/*/*
+ ExecStart=/bin/chmod -R og-r /etc/letsencrypt/archive/
  ExecStartPost=/usr/sbin/service sendmail restart
  PrivateTmp=true
 ==Other stuff==

@@ Line 63: / Line 63: @@
  ExecStartPre=/usr/bin/certbot -q renew
  ExecStart=/bin/chmod og-r /etc/letsencrypt/archive/*/*
- ExecStartPost=service sendmail restart
+ ExecStartPost=/usr/sbin/service sendmail restart
  PrivateTmp=true

← Older revision		Revision as of 13:58, 15 March 2021
Line 49:		Line 49:

	Related to [http://www.antradar.com/blog-fixing-gmails-tls-negotiation-failed-error-2020 Gmail-TLS-negotiation failed] error		Related to [http://www.antradar.com/blog-fixing-gmails-tls-negotiation-failed-error-2020 Gmail-TLS-negotiation failed] error
		+
		+	===Sendmail file permissions===
		+	certbot stores all cert files with group/other read permission. This is OK, as they are in a directory that only has owner-access, but sendmail still doesn't trust it, and fails to load the cert files. Currently I'm trying to fix this with:
		+
		+	cat /lib/systemd/system/certbot.service
		+
		+	[Unit]
		+	Description=Certbot
		+	Documentation=file:///usr/share/doc/python-certbot-doc/html/index.html
		+	Documentation=https://letsencrypt.readthedocs.io/en/latest/
		+	[Service]
		+	Type=oneshot
		+	ExecStartPre=/usr/bin/certbot -q renew
		+	ExecStart=/bin/chmod og-r /etc/letsencrypt/archive//
		+	ExecStartPost=service sendmail restart
		+	PrivateTmp=true

@@ Line 51: / Line 51: @@
-==dhparams file==
+==Other stuff==
 The dhparam.pem can be generated with:
  openssl dhparam -out /etc/mail/certs/dhparam4096.pem 4096

← Older revision		Revision as of 21:30, 13 October 2020
Line 56:		Line 56:
	And in sendmail:		And in sendmail:
	define(`confDH_PARAMETERS', `/etc/mail/certs/dhparam4096.pem')dnl # <= EDIT		define(`confDH_PARAMETERS', `/etc/mail/certs/dhparam4096.pem')dnl # <= EDIT
		+
		+	Client email servers that cause:
		+	Oct 13 23:18:21 localhost sm-mta[2690]: STARTTLS=client, error: connect failed=-1, reason=unsupported protocol, SSL_error=1, errno=0, retry=-1
		+	Oct 13 23:18:21 localhost sm-mta[2690]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.example.com, reject=403 4.7.0 TLS handshake failed.
		+	Only way I've found, is [https://serverfault.com/questions/701934/sendmail-down-on-ubuntu-12-04-after-update-ssl-related disabling TLS] for these servers:
		+	Try_TLS:example.com NO

← Older revision		Revision as of 21:10, 13 October 2020
Line 49:		Line 49:

	Related to [http://www.antradar.com/blog-fixing-gmails-tls-negotiation-failed-error-2020 Gmail-TLS-negotiation failed] error		Related to [http://www.antradar.com/blog-fixing-gmails-tls-negotiation-failed-error-2020 Gmail-TLS-negotiation failed] error
		+
		+
		+	==dhparams file==
		+	The dhparam.pem can be generated with:
		+	openssl dhparam -out /etc/mail/certs/dhparam4096.pem 4096
		+	And in sendmail:
		+	define(`confDH_PARAMETERS', `/etc/mail/certs/dhparam4096.pem')dnl # <= EDIT

← Older revision		Revision as of 10:17, 18 April 2020
Line 20:		Line 20:

	Note that this fails: sendmail doesn't like the /etc/letsencrypt/archive/pomo.komputilo.org/privkey1.pem file being group&world readable.		Note that this fails: sendmail doesn't like the /etc/letsencrypt/archive/pomo.komputilo.org/privkey1.pem file being group&world readable.
		+	chmod 0600 /etc/letsencrypt/live/pomo.komputilo.org/privkey.pem

	To test:		To test:

@@ Line 13: / Line 13: @@
  define(`confCLIENT_KEY',   `/etc/letsencrypt/live/pomo.komputilo.org/privkey.pem')dnl
  define(`confAUTH_OPTIONS', `A p y')dnl
 To test:

← Older revision		Revision as of 08:41, 18 April 2020
Line 38:		Line 38:
	To obtain the certificate (see [https://cromwell-intl.com/open-source/sendmail-ssl.html here]):		To obtain the certificate (see [https://cromwell-intl.com/open-source/sendmail-ssl.html here]):
	openssl s_client -connect pomo.komputilo.org:465 -tls1_2		openssl s_client -connect pomo.komputilo.org:465 -tls1_2
		+
		+
		+	Related to [http://www.antradar.com/blog-fixing-gmails-tls-negotiation-failed-error-2020 Gmail-TLS-negotiation failed] error

@@ Line 36: / Line 36: @@
 HELP
-To obtain the certificate (see [https://cromwell-intl.com/open-source/sendmail-ssl.html here):
+To obtain the certificate (see [https://cromwell-intl.com/open-source/sendmail-ssl.html here]):
  openssl s_client -connect pomo.komputilo.org:465 -tls1_2