<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>-- Sorry as wrong identity and I expect the other to fail, I apologize if you get this twice.</p>
<p><br /></p>
<p>Thanks Stephen, this seems to be about the right time, but I think my problems started before this. </p>
<p>I have not tried combining the primary chain with the intermediate chain and then making Dovecot use that. I think that is my next step. I just haven't had time to mess with it further since making my phone accept the cert was an easy fix so I could get back to work.</p>
<p><br /></p>
<p><br /></p>
<p>On 2018-04-13 15:44, Stephen Partington wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><a href="https://www.ssllabs.com/ssltest/analyze.html?d=codezilla.xyz">https://www.ssllabs.com/ssltest/analyze.html?d=codezilla.xyz</a></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"> </span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">So it looks great.</span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"> </span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">This does look like a feature change was recently done. <a href="https://letsencrypt.org/2018/04/04/sct-encoding.html">https://letsencrypt.org/2018/04/04/sct-encoding.html</a></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"> </span></div>
</div>
<div class="gmail_extra"><br />
<div class="gmail_quote">On Fri, Apr 13, 2018 at 3:03 PM, Stephen Partington <span><<a href="mailto:cryptworks@gmail.com">cryptworks@gmail.com</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
<div dir="ltr">
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">Sorry, I lost this off my radar.</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><a href="https://letsencrypt.org/docs/integration-guide/">https://letsencrypt.org/docs/<wbr />integration-guide/</a> has some interesting information. Have you tested your ssl?</span></div>
</div>
<div class="gmail_extra">
<div>
<div class="h5"><br />
<div class="gmail_quote">On Fri, Apr 13, 2018 at 2:47 PM, Nathan O'Brennan <span><<a href="mailto:plugaz@codezilla.xyz">plugaz@codezilla.xyz</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><span><span>On 2018-04-12 11:27, Matt Birkholz wrote:<br /></span></span>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">Hi Nathan,<br /> <br /> Did you get any help with this, or figure it out yourself by now?</blockquote>
No, to be honest I haven't seen a single response, but I have also not seen any email come in since I sent it, so I kind of thought maybe my certificate was messed up somehow else.<br /> <br /> I ended up having my phone accept the certificate so I could check my mail, but I never did resolve it. It works correctly everywhere, and on my phone as long as it does not try to verify, so I left it alone.
<div class="m_-4197598283712719865HOEnZb">
<div class="m_-4197598283712719865h5"><br /> <br /> <br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><br /> I have been doing similar things on a CoxBusiness static IP for years,<br /> so maybe I can help. (Also Mike's latest silliness makes me wish for<br /> more erudite discussions on PLUG. Smart questions going unanswered<br /> only makes it worse? :-)<br /> <br /> I included a couple quick "reactions" to your email (below) but maybe<br /> this is moot now, a week on.<br /> <br /> -Matt<br /> <br /> On Thu, 2018-04-05 at 20:29 -0700, Nathan O'Brennan wrote:<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">Hey all,<br /> <br /> I use Let's Encrypt on my web server, and I use the same certificate for<br /> my postfix and dovecot services. Today I realized that my phone has not<br /> alerted me to new messages. I logged into my webmail via Firefix (I<br /> don't usually log into webmail until my phone says I have mail) and sure<br /> enough, I had quite a bit of mail, so I opened my BlueMail app and it<br /> will not connect because my certificate cannot be verified.<br /> <br /> Firefox works fine on webmail.<br /> Chrome works fine on webmail.<br /> Postfix, Apache, and Dovecot all operate correctly without warnings.<br /> <br /> Bluemail, Thunderbird, and Kmail all fail to connect because the<br /> certificate cannot be verified.</blockquote>
<br /> You did not attach the intermediate certificates?<br /> <br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">I had to accept the certificate to use it on my phone. Has Let's Encrypt<br /> changed something? Or what? I don't get any errors on my server, dovecot<br /> reports a username of <> during the initial handshake, which I think is<br /> normal, then reports an error only when my phone attempts to connect<br /> which looks like:<br /> <br /> <br /> Apr 05 20:26:23 <a href="http://codezilla.xyz">codezilla.xyz</a> dovecot[1699]: imap-login: Disconnected<br /> (no auth attempts in 3 secs): user=<>, rip=70.xxx.aaa.162,<br /> lip=138.197.192.135, TLS handshaking: SSL_accept() failed:<br /> error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate<br /> unknown: SSL alert number 46, session=<xsrZniVpOQBGsb2i><br /> <br /> Best I can tell this is a failure on my server's attempt to verify my<br /> phone's certificate?</blockquote>
<br /> Your phone has an IMAP client certificate? I missed that part.<br /> <br /> The error message actually looks like mine when certificates do not<br /> validate and clients do not attempt to log in.<br /> <br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">Any help would be appreciated.<br /> ------------------------------<wbr />---------------------<br /> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.or<wbr />g</a><br /> To subscribe, unsubscribe, or to change your mail settings:<br /> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss">http://lists.phxlinux.org/mail<wbr />man/listinfo/plug-discuss</a></blockquote>
</blockquote>
</div>
</div>
<br />------------------------------<wbr />---------------------<br /> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.or<wbr />g</a><br /> To subscribe, unsubscribe, or to change your mail settings:<br /> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss">http://lists.phxlinux.org/mail<wbr />man/listinfo/plug-discuss</a></blockquote>
</div>
<br /><br clear="all" />
<div> </div>
</div>
</div>
<span class="HOEnZb"><span class="HOEnZb"><span style="color: #888888;">-- <br /></span></span></span>
<div class="m_-4197598283712719865gmail_signature">A mouse trap, placed on top of your alarm clock, will prevent you from rolling over and going back to sleep after you hit the snooze button.<br /><br />Stephen<br /><br /></div>
</div>
</blockquote>
</div>
<br /><br clear="all" />
<div> </div>
-- <br />
<div class="gmail_signature">A mouse trap, placed on top of your alarm clock, will prevent you from rolling over and going back to sleep after you hit the snooze button.<br /><br />Stephen<br /><br /></div>
</div>
<br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">---------------------------------------------------<br /> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a><br /> To subscribe, unsubscribe, or to change your mail settings:<br /> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a></div>
</blockquote>
<p><br /></p>
</body></html>