SSL issues with mail.domain.com Sectigo

tramp said:

I'm having issues with the installation of SSL certificates for my linux VPS.

Currently i bought two Sectigo SSL certificates for my VPS. I'm running my machine with the hostname exampleX.example.com, my website is matching the hostname, so it's exampleX.com, for my email i use the mail.exampleX.com variation.

I've hosted my VPS with TransIP in the Netherlands, they make a suggestion on how to install the certificates on the VPS bought from them, you can find it here. When i follow the instructions everything goes (pretty) well. The Sectigo certificate for the website exampleX.com is directly installed. When i start with installing the certificate bought for mail.exampleX.com, i run into the problem that as soon as i restart exim, all the websites hosted on my server are down. The mail is secured from that moment on, but the sites are all offline.

How do i fix this situation? It seems to me nothing impossible or weird situation?

Click to expand...

sparek said:

Is the Sectigo certificate valid for mail.example.tld?

Click to expand...

bdacus01 said:

The domain name of the server needs to match the domain name you own. So if the the domain at the Registrar is

mydomainnameX.com .

The server name should be mysevername.mydomainnameX.com this is the FDQN of the server. The my server name part can be anything cool like raptor, eagle, voldemort, and so on. It's just the name of the server... Ref . https://www.itzgeek.com/how-tos/linux/centos-how-tos/change-hostname-in-centos-7-rhel-7.html

Which would make the website https://mydomainnameX.com or https://www.mydomainnameX.com

mail.mydomainnameX.com

in directadmin.conf did you set all features?

https://help.directadmin.com/item.php?id=15

[h=1]Installing a Purchased Certificate[/h]

Click to expand...

sparek said:

example.tld would have to have it's own VirtualHost container.

and mail.example.tld would have to have it's own VirtualHost container.

Sorta, kinda, related to my post at:

https://forum.directadmin.com/showthread.php?t=58182

I don't exactly know how you have this set up.

You would need to have a VirtualHost container:

<VirtualHost %ip%:443 >
...
ServerName example.tld
...
</VirtualHost>

And a VirtualHost container:

<VirtualHost %ip%:443 >
...
ServerName mail.example.tld
...
</VirtualHost>

The ServerName example.tld VirtualHost would link to example.tld's certificate and key with the SSLCertificateFile and SSLCertificateKeyFile directives.

The ServerName mail.example.tld VirtualHost would link to mail.example.tld's certificate and key with the SSLCertificateFile and SSLCertificateKeyFile directives.

Click to expand...

tramp said:

I don't want to host any content on the mail.domain.com address. I just want to secure the connection of the email.
I'm at the point now, i just don't care with which certificate we're doing this. I'm working on it now for 3 days on a row, and certainly it isn't that easy. I've spoken to various people, from my hosting provider up to de helpdesk op DA, and nobody can get it working for me.

If it's that easy. Please give a noob explenation for this, because im really getting frustrated up here.

In my frustration, i forget about a quite important part of the story.

The websites hosted on the VPS are using hostname server.domain.com, the email uses the hostname mail.domain.com :'-)

Click to expand...

smtalk said:

A pretty simple explanation for everyone. If you want to HOST content on mail.domain.com, for example, but your website here - you need to create subdomain or domain for it If you don't want to host your website there, HTTP protocol test is not the one you should use to check if IMAP/POP3/SMTP have a certificate. If https://mail.domain.com does not have certificate, it does not mean imap/pop3/smtp don't have it too. I hope it helps people to understand what this thread was about. Thank you.

Click to expand...

tls_certificate=${\
     if exists{\
         /etc/virtual/snidomains\
     }\
     {\
         ${\
             lookup{\
                 $tls_in_sni\
             }\
             nwildlsearch{\
                 /etc/virtual/snidomains\
             }\
             {\
                 ${\
                     if exists{\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.cert.combined\
                     }\
                     {\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.cert.combined\
                     }\
                     {\
                        ${\
                                if exists{\
                                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                                }\
                                {\
                                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                                }\
                                {\
                                        /etc/exim.cert\
                                }\
                        }\
                     }\
                 }\
             }\
             {\
                ${\
                        if exists{\
                                /opt/extra_certificates/$tls_in_sni.cert.combined\
                        }\
                        {\
                                /opt/extra_certificates/$tls_in_sni.cert.combined\
                        }\
                        {\
                                /etc/exim.cert\
                        }\
                }\
             }\
        }\
     }\
     {\
        ${\
                if exists{\
                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                }\
                {\
                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                }\
                {\
                        /etc/exim.cert\
                }\
        }\
     }\
}


tls_privatekey=${\
     if exists{\
         /etc/virtual/snidomains\
     }\
     {\
         ${\
             lookup{\
                 $tls_in_sni\
             }\
             nwildlsearch{\
                 /etc/virtual/snidomains\
             }\
             {\
                 ${\
                     if exists{\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.key\
                     }\
                     {\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.key\
                     }\
                     {\
                        ${\
                                if exists{\
                                        /opt/extra_certificates/$tls_in_sni.key\
                                }\
                                {\
                                        /opt/extra_certificates/$tls_in_sni.key\
                                }\
                                {\
                                        /etc/exim.key\
                                }\
                        }\
                     }\
                 }\
             }\
             {\
                ${\
                        if exists{\
                                /opt/extra_certificates/$tls_in_sni.key\
                        }\
                        {\
                                /opt/extra_certificates/$tls_in_sni.key\
                        }\
                        {\
                                /etc/exim.key\
                        }\
                }\
             }\
        }\
     }\
     {\
        ${\
                if exists{\
                        /opt/extra_certificates/$tls_in_sni.key\
                }\
                {\
                        /opt/extra_certificates/$tls_in_sni.key\
                }\
                {\
                        /etc/exim.key\
                }\
        }\
     }\
}

sparek said:

But you can't install a secure certificate for mail.example.tld - for use in Dovecot and Exim SNI - unless mail.example.tld exists as a VirtualHost... correct?

I mean... you can't specify to install a secure certificate on a domain name unless that domain name is attached to a user... at least with the API.

Although... personally... for me I'm looking at developing my own system to handle mail.example.tld for Exim and Dovecot... since I really just plan to use Let's Encrypt certificates for this.

Doing this in Dovecot is simple enough, simply create an include file i.e. /etc/dovecot/conf.d/999-custom_sni.conf - with contents:

local_name "mail.example.tld" {
ssl_cert = </opt/extra_certificates/mail.example.tld.combined
ssl_key = </opt/extra_certificates/mail.example.tld.key
}

Exim is way more complicated (I always have trouble with their if statements), but something like: (sorry for the multi-line but I think it makes it easier to read):

Code:

tls_certificate=${\
     if exists{\
         /etc/virtual/snidomains\
     }\
     {\
         ${\
             lookup{\
                 $tls_in_sni\
             }\
             nwildlsearch{\
                 /etc/virtual/snidomains\
             }\
             {\
                 ${\
                     if exists{\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.cert.combined\
                     }\
                     {\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.cert.combined\
                     }\
                     {\
                        ${\
                                if exists{\
                                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                                }\
                                {\
                                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                                }\
                                {\
                                        /etc/exim.cert\
                                }\
                        }\
                     }\
                 }\
             }\
             {\
                ${\
                        if exists{\
                                /opt/extra_certificates/$tls_in_sni.cert.combined\
                        }\
                        {\
                                /opt/extra_certificates/$tls_in_sni.cert.combined\
                        }\
                        {\
                                /etc/exim.cert\
                        }\
                }\
             }\
        }\
     }\
     {\
        ${\
                if exists{\
                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                }\
                {\
                        /opt/extra_certificates/$tls_in_sni.cert.combined\
                }\
                {\
                        /etc/exim.cert\
                }\
        }\
     }\
}


tls_privatekey=${\
     if exists{\
         /etc/virtual/snidomains\
     }\
     {\
         ${\
             lookup{\
                 $tls_in_sni\
             }\
             nwildlsearch{\
                 /etc/virtual/snidomains\
             }\
             {\
                 ${\
                     if exists{\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.key\
                     }\
                     {\
                         /usr/local/directadmin/data/users/${extract{1}{:}{$value}}/domains/${extract{2}{:}{$value}}.key\
                     }\
                     {\
                        ${\
                                if exists{\
                                        /opt/extra_certificates/$tls_in_sni.key\
                                }\
                                {\
                                        /opt/extra_certificates/$tls_in_sni.key\
                                }\
                                {\
                                        /etc/exim.key\
                                }\
                        }\
                     }\
                 }\
             }\
             {\
                ${\
                        if exists{\
                                /opt/extra_certificates/$tls_in_sni.key\
                        }\
                        {\
                                /opt/extra_certificates/$tls_in_sni.key\
                        }\
                        {\
                                /etc/exim.key\
                        }\
                }\
             }\
        }\
     }\
     {\
        ${\
                if exists{\
                        /opt/extra_certificates/$tls_in_sni.key\
                }\
                {\
                        /opt/extra_certificates/$tls_in_sni.key\
                }\
                {\
                        /etc/exim.key\
                }\
        }\
     }\
}

You can add this exim code into /etc/exim.variables.conf replacing the current tls_certificate and tls_privatekey and you probably have to convert it into a single line (?), but it should work. At least assuming I've got the convoluted nested if's set correctly.

This way I can put extra - non-DirectAdmin created - Let's Encrypt certificates (or any certificate for that matter) in /opt/extra_certificates and Dovecot and Exim will be able to pick up on them. This negates the need for mail.example.tld to exist as a VirtualHost but still allows SNI to be used for Exim and Dovecot.

Maybe this post will be useful to someone?

Click to expand...

sparek said:

Well, it really doesn't matter if it's set up as a subdomain or as a domain... the end result is the same... a VirtualHost container for ServerName mail.example.tld gets created.

Click to expand...