Error in loading TLS certificate

Support
1

NethServer Version: 8
Module: TLS Certificates

I have and error when I try to load a TLS certificate on Neth Server

image
image1615Ă—102 6.36 KB

Can you help me to understand why?

Thanks in advance.

Alessio

2

Is the uploaded certificate listed on the TLS certificate page?

NS8 expects the domain in the “Subject” field of the certificate but it may contain something else, see also Certificate upload Error - #9 by mrmarkuz

3

Hello, thank you for your answer. I found that the error message its probably a bug or something similar.
After I got the error I found that the certificate was loaded correctly

image
image1584Ă—271 8.81 KB

So can I send you some logs to identify if it is a bug or anything else?

Regards.

Alessio

1 Like
4

Thanks for your feedback and welcome to NethServer Community.

Just to confirm the bug, could you share the certificate subject?

openssl x509 -noout -subject -in YOURCERTFICATE.crt -nameopt sep_multiline -nameopt utf8
5

Here is:

subject=
C=IT
ST=SI
L=Cusona
O=Trigano S.p.a.
OU=IT
CN=smtp.domain.tld
emailAddress=user@domain.tld

Alessio

1 Like
6

Thanks, I’ll have a look at it.
I masked your domain and email.

7

Moreover I found another issue: it seems that the uploaded TLS certificate is not used by Email app for STARTTLS/SSL connections.

How can I achieve that?

Alessio

8

Many thanks for obfuscation

1 Like
9

Does it help to click save in the NS8 mail settings to restart the mail services?

Or restart postfix from CLI:

runagent -m mail1 systemctl --user restart postfix
10

I tried everything you suggested me, but no way. I tried to reboot the server also.

Anyway I did not find anything related to certificates in email application settings.

Is it right?

Alessio

11

Anyway I did not find anything related to certificates in email application settings.

Is it right?

Yes, that is right.

12

Ok, anyway it seems there are no certificates when I try a STARTTLS connection on port 587 of the SMTP relay.

Any ideas?

13

You could try following command to install the cert in postfix:

runagent -m mail1 install-certificate postfix

See also Dovecot Certificate Expired - #3 by mrmarkuz

14

I got a warning:

image

But I checked and a certificate for that fqdn is present in TLS certificates under Cluster settings.

15

At the end I managed to achieve my goal to have certificate on smtp relay: I copy needed files in /home/mail1/.local/share/containers/storage/volumes/postfix-cert/_data/ folder

I had to create three files:

image

Now the relay it’s up and running.

1 Like