Issue TLS: SSL_read failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL a

[Bludau Media]

My error Message is:

Jan 15 10:59:16 mail dovecot: imap-login: Disconnected (no auth attempts ics): user=<>, rip=77.179.18.XXX, lip=XXX.XXX.XXX.XXX, TLS: SSL_read failed: e4094412:SSL routines:ssl3_read_bytes:sslv3
alert bad certificate: SSL alert number 42

/etc/dovecot/private/
+ dovecot.pem
+ ssl-cert-and-key.pem

are existing. If i change to let's encrypt i see that the dovecot.pem date is changing.

i can't use Email Clients with START TLS / SSL. Without it works and i can receive the emails.

 

[Brujo]

please take into consider to tell a bit more in detail,like which clients. There are several knowledgebase articles around about this issue with different solutions. and how looks like your /etc/dovecot/conf.d/11-plesk-security-ssl.conf

 

[Bludau Media]

it seems to be an invalid SSL-Cert.
i have changed the PTR DNS Record to a lokal domain not the default servername by the hoster Server4you.
Than i changed the serverpool certs to lets encrypt with a new domain mail.luvotec.de for example.

my /etc/dovecot/conf.d/11-plesk-security-ssl.conf show this

ssl_cipher_list=EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EECDH+CHACHA20:EDH+AESG$
ssl_protocols = TLSv1 TLSv1.1 TLSv1.2
ssl_min_protocol=TLSv1
ssl_prefer_server_ciphers=yes
ssl_dh=</usr/local/psa/etc/dhparams1024.pem
ssl=yes
ssl_cert=</etc/dovecot/private/dovecot.pem
ssl_key=</etc/dovecot/private/dovecot.pem

i have several root servers at Server4you but only this Server isn't working.
i've migrated the data from one server to another.
There is a little bug the "Email Server functionaly working with plesk is disabled" and really no email server cert is setup (means not the default self signed cert)

 

[Bludau Media]

the problem is that the Cert Name under mail.luvotec.de points to another domain name, the default servername from the hosting provider not the customized one, that should be mail.luvotec.de not xxxx.startdedicated.de.

It seems to be a plesk bug.

SSL Server Test: mail.luvotec.de (Powered by Qualys SSL Labs)

 

[Bludau Media]

-->--

SMTPS

echo | openssl s_client -connect xxx.xxx.xxx.xxx:993 2>&1 -tls1_2 | openssl x509 -noout -text | grep 'CN\|Issuer\|Not After\|DNS'
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Not After : Apr 14 08:47:44 2020 GMT
Subject: CN=mail.luvotec.de
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
DNS:mail.luvotec.de

-->--

IMAPS

echo | openssl s_client -connect xxx.xxx.xxx.xxx:465 2>&1 -tls1_2 | openssl x509 -noout -text | grep 'CN\|Issuer\|Not After\|DNS'
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Not After : Apr 14 08:47:44 2020 GMT
Subject: CN=mail.luvotec.de
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
DNS:mail.luvotec.de

-->--

 

[Bludau Media]

apple mail, thunderbird, outlook are working if i use atlantic254.startdedicated.de as IMAPS and SMTPS works with the mentioned result of SSLlab ssllabs.com

SSL Server Test: mail.luvotec.de (Powered by Qualys SSL Labs)