Dovecot Certificate Expired

[strauch]

NethServer Version: ns8
Module: dovecot

Hello, today i realized that dovecot uses another certificate than traefik. When i changed from ns7 to ns8 i first used the automatic installed mail certificate. Later i put ns8 behind an nginx proxy for 80,443 so it cant renew the certificate itself. An i uploaded a wildcard certificate to ns8. this works for all other applications like nextcloud, cluster-admin etc.

So i deleted all certificates and give direct access via 80 and 443 so ns8 can install itself a new certificate. This works, but dovecot always get the old certificate. Can someone give me and advice where the certificates are stored. I found a few topics like

TLS certificate error with mail host aliases

Hi @davidep It’s easy to find the certificate-mail.domain.com.yml. Per the docs, I believe the correct syntax would be this: http: routers: certificate-mail.domain.com: entrypoints: https service: ping@internal rule: Host(`mail.domain.com`) && Path(`/cd98a9c8-24c2-441b-a6d5-159afe0b1822`) priority: '1' tls: domains: - main: mail.domain.com sans: - "smtp.domain.com" - "imap.domain.com" certresolver: ac…

Setting the dovecot certificate with import-certificate

NethServer Version: Nethserver 8 Module: mail Github tells me that I can use import-certificate to provide the correct certificate (wildcard domain certificate) to dovecot (I have a client that insists on certificate validation). import-certificate Reads a Tar file from standard input. The following archive contents are relevant: server.pem, server TLS certificate server.key, server certificate private key dh.pem, Diffie-Hellman group However, I cannot for the life of me figur…

Or how i can use the wildcard certificate with dovecot.

Thank you

strauch

[strauch]

With redis-exec HGET "module/${mtraefik}/certificate/${MAIL_HOSTNAME}" key in mail1 i got the wrong certificate, but where is the file behind that?

[mrmarkuz (Markus Neuberger)]

@strauch

Or how i can use the wildcard certificate with dovecot.

Does it help to reinstall the certificate in dovecot?

runagent -m mail1 install-certificate dovecot

That should put the right cert to /home/mail1/.local/share/containers/storage/volumes/dovecot-cert/_data/.

@strauch

where is the file behind that?

Traefik stores it’s certs in one file in /etc/traefik/acme/acme.json, to access it in the container using vi you could use following command:

runagent -m traefik1 podman exec -ti traefik vi /etc/traefik/acme/acme.json

[strauch]

Hello Markus, thank you for your help, with the command:

runagent -m mail1 install-certificate dovecot

i got the old certificate again in this place. When i delete the files in the folder /home/mail1/.local/share/containers/storage/volumes/dovecot-cert/_data/ i got the files again, after i run the above command.
It seems like the acme dind’t install a new certificate, when i run it i cant see anything in the logfile. Do you now the command to execute it from the cli to see any answer in the bash?

[strauch]

puhh i got it. there was an error to write in the acme.json. i only edit this file. restart the service and in the logfiles i see, that he renew the certificate… thanks for your advice that brings me on the right way.