Issue Plesk mail on iphone with cert problems

[Alex Cote]

Im having problems with the free certs generated by plesk. They are not updating after expiration and my clients iphones not updating with the new cert info.
Gets anoying as hell to have to reinstall the mail accounts every 3 months.

What do I need to do to fix this issue?

 

[Bitpalast]

Some Apple mail installations are not able to handle a renewal of Let's Encrypt certificates. When a certificate is renewed, the devices think, it is a brand new certificate, not a renewal of the existing certificate. That is why they do not accept these certificates. It is a known Apple bug that has been a round since Let's Encrypt became popular. Last thing that I remember was that you need to update the device's operating system and mail app to solve the issue.

 

[Alex Cote]

Im also getting problems on thunderbird so its not an apple only problem...

 

[Bitpalast]

And what exactly is your problem on Thunderbird?

 

[Alex Cote]

Same cert expires and I have to delete the account and reinstall it to get to work. If not it just gets stuck with the old expired cert. pop-up comes up to renew and it doesnt change.

 

[Bitpalast]

So the issue is not that the iPhone or Thunderbird don't accept a re-issued cert, but your issue is that the cert itself is not automatically updated and you have to update the cert manually in Plesk. Is that so?

 

[Alex Cote]

Thats correct! exactly

 

[Bitpalast]

Are you using the "SSLit!" extension to maintain your certificates? If not, can you switch to it, because it is a requirement for some configurations.
Are you using SNI? Are you using wildcard certificates? In the past there have been reports where in both cases certificates cannot be auto-re-issued.

 

[Alex Cote]

Im using SSL it yes,
SNI mmmmm I dont know... how do I check for this?
Im using the lets encrypt certs...

 

[Bitpalast]

SNI: When you create or reissue a certificate you can determine what components shall be included in the certificate. For example you can add the "Mail access". In the "Mail Settings" you will also need to select the certificate from the "SSL/TLS certificate for mail" if you do not use the host name for your mail program.

I am only asking to narrow down the certificate issue. It is not really directly linked to this, but you need to be very exact what cert you have where and how you use it. Also, when the cert does not renew, you should get an error message why it does not automatically renew. Have you seen such an error message, e.g. in an email notification?

Normally, when a cert cannot be auto-renewed, the cause is a faulty DNS record of the domain. Are you using the Plesk DNS system or is your DNS external? Are you using cloudflare for example that might block a request from Let's Encrypt to your server? Is your DNS configured correctly so that only a single IP is listed for the domain and not multiple IPs that might not be correct? Are you using IPv6 or IPv4 only?

 

[Alex Cote]

Im using cloudflare yes...

 

[Alex Cote]

Im on a shared IP at OVH.

 

[Bitpalast]

Could it be an issue like this one?

Let's Encrypt attempts to renew a certificate for a domain in Plesk, which has a CloudFlare certificate configured

Applicable to: Plesk for Linux Symptoms The following notifications are received by Plesk Administrator: CONFIG_TEXT: The following domains have been secured without some of their Subject Altern...

support.plesk.com

 

[Alex Cote]

Nah thats not it. Im still using the plesk lets encrypt cert. So shouldnt be a problem.
And my DNS entry is opened. Not filtered.

 

[Bitpalast]

But you do get an error message when a cert renewal fails? What exactly does it say?

If you have not received it by mail, you can look into /var/log/plesk/panel.log. All renewal errors are logged there, no debug mode necessary. Can you provide the error message here (with redacted domain and IP)?

 

[Alex Cote]

Happened 3 weeks ago. Next time Ill report back here. Thanks for your help Peter!

 

[Alex Cote]

Issue is back after the cert expiring last night. I get the not trusted on all apple devices. And cant event press to get it accpet the renewal.

 

[Alex Cote]

Is there a better way to get this solved. ? buy a 1 year SSL? I dont care about the site since I use cloudflare. I only care about the emails.