Support for Email Server TLS encryption on Sentora?

[Me.B]

You can generate a certitificate with let's encrypt to use with postfix. You can use HTTP or DNS validation for that.

M B

[zanga]

Thank you !

[zanga]

I generated a certificate with let's encrypt but I guess I'm missing  something.
When I do a check with www.checktls.com I see:

Code:

[001.123]        Connection converted to SSL
[001.127]        
Certificate 1 of 1 in chain:
serialNumber= 42:f5:37:78:04:97:4f:80:05:33:15:c0:00:8b:74:de:8b:e
subject= /CN=mail.domain.com
issuer= /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
[001.127]        Cert VALIDATION ERROR(S): unable to get local issuer certificate, certificate not trusted, unable to verify the first certificate
[001.127]        This may help: What Is An Intermediate Certificate
[001.127]        So email is encrypted but the recipient domain is not verified

[TGates]

did you make a certificate for mail.domain.com or just for domain.com? It needs to be for mail.domain.com specifically.

[zanga]

It was created for mail.domain.com

[TGates]

Since we are new to the SSL thing, I had to check Google. There are a bunch of suggestions for you to try or check.
A couple examples suggest you're referencing the wrong intermediate certificate.
Google: Cert VALIDATION ERROR(S): unable to get local issuer certificate, certificate not trusted, unable to verify the first certificate

[betatester3.0]

I generated a certificate with let's encrypt but I guess I'm missing  something.
When I do a check with www.checktls.com I see:

Code:

[001.123]        Connection converted to SSL
[001.127]        
Certificate 1 of 1 in chain:
serialNumber= 42:f5:37:78:04:97:4f:80:05:33:15:c0:00:8b:74:de:8b:e
subject= /CN=mail.domain.com
issuer= /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
[001.127]        Cert VALIDATION ERROR(S): unable to get local issuer certificate, certificate not trusted, unable to verify the first certificate
[001.127]        This may help: What Is An Intermediate Certificate
[001.127]        So email is encrypted but the recipient domain is not verified

I have that issue with the mail server and google. it is now compulsory to have a ssl/ttl connection for google to show/display the secure lock icon as well as the mail not being sent straight to spam into the gmail mailbox.

and stay away from port 25 that will give you that warning from google, and for whatever reason they seem to not deliver the emails to the gmail server. or you have set this up at home and your isp screwed there config.

for my Sentora test server which I run at home did that and I traced the error back to the ISP, they had to configure there mail client correctly.

[zanga]

Found the issue, in the postfix configuration I added the cert instead of the fullchain and the private key.
All green now

[TGates]

Glad you sorted it out

[CMs222]

Found the issue, in the postfix configuration I added the cert instead of the fullchain and the private key.
All green now

when you say you added the cert (which caused error)

smtp_use_tls = no
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
smtpd_tls_key_file = /etc/letsencrypt/live/mail.domain.tk/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.domain.tk/cert.pem   < WHAT SHOULD I PUT HERE IF NOT CERT PATH?
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.domain.tk/fullchain.pem

as you see above in postfix main.cnf 
I added cert path ????

what should go there to stop error?