0

I'm trying to polish up my mailserver so that all tls certificates match, and everything runs as perfectly as possible. I can receive email just fine. I can also send email, however when mutt checks the smtp certificate, it tells me the hostname doesn't match the certificate. I ~could~ disable certificate checking, but that seems like it just masks the symptoms instead of fixing the problem. Its my intention to force the use of TLS for both IMAP receiving and SMTP sending. I don't intend for POP access at all.

From what I can tell, the server hostname is correctly set, and it's being reported by both the kernel and postfix config.

My server hostname does have an A record in DNS that points to the correct IP.

  • The server webmail can be accessed using https://webmail.poindexter.farm/ username and password are below
  • SMTP(postfix) and IMAP(dovecot) are both on hwsrv690473.poindexter.farm
  • I've created a test user account to help any of you, username and password are both "test"

Any help would be much appreciated!

mutt complaining about certificate

dns records

A magic ssl command I was asked to run... I have no idea how it works.

brad@mini-odin:~ $ echo "" | openssl s_client -connect poindexter.farm:587 -starttls smtp | openssl x509 -noout -text | grep -1 'Alternative Name'
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify error:num=20:unable to get local issuer certificate
verify return:0
250 SMTPUTF8
DONE

            X509v3 Subject Alternative Name: 
                DNS:hwsrv-690473.poindexter.farm

muttrc on client computer

brad@mini-odin:~ $ cat .muttrc
# vi ~/.muttrc
# About Me
set from = "[email protected]"
set realname = "test account"

# My credentials
set smtp_url = "smtp://[email protected]:587/"
set smtp_pass = "test"

set imap_user = "test" #-This allows login when opening mutt
set imap_pass = "test"
#set smtp_authenticators="login" 

set ssl_starttls = yes 
set ssl_force_tls = yes 

# My mailboxes
set folder = "imaps://hwsrv-690473.poindexter.farm:993"
set spoolfile = "+INBOX"


# Where to put the stuff
set header_cache = "~/.mutt/cache/headers"
set message_cachedir = "~/.mutt/cache/bodies"
set certificate_file = "~/.mutt/certificates"

# Etc
set mail_check = 30
set move = no
set imap_keepalive = 900
set sort = threads
set editor = "vim"

# GnuPG bootstrap
# source ~/.mutt/gpg.rc
brad@mini-odin:~ $

mutt debug file from the point of hitting y to send a composed email

brad@mini-odin:~ $ cat .muttdebug0
[2020-06-11 11:57:36] In mutt_reflow_windows
[2020-06-11 11:57:38] Sending message...
[2020-06-11 11:57:38] ../../sendlib.c:2782: mutt_mktemp returns "/tmp/mutt-mini-odin-1001-25828-368841125475337537".
[2020-06-11 11:57:38] mwoh: buf[Subject: test email] is short enough
[2020-06-11 11:57:38] ../../send.c:987: mutt_mktemp returns "/tmp/mutt-mini-odin-1001-25828-15718660201142318120".
[2020-06-11 11:57:38] mwoh: buf[Subject: test email] is short enough
[2020-06-11 11:57:38] Looking up poindexter.farm...
[2020-06-11 11:57:38] Connecting to poindexter.farm...
[2020-06-11 11:57:38] Connected to poindexter.farm:587 on fd=5
[2020-06-11 11:57:38] 5< 220 hwsrv-690473.poindexter.farm ESMTP Postfix (Debian/GNU)
[2020-06-11 11:57:38] 5> EHLO localhost
[2020-06-11 11:57:38] 5< 250-hwsrv-690473.poindexter.farm
[2020-06-11 11:57:38] 5< 250-PIPELINING
[2020-06-11 11:57:38] 5< 250-SIZE 10240000
[2020-06-11 11:57:38] 5< 250-VRFY
[2020-06-11 11:57:38] 5< 250-ETRN
[2020-06-11 11:57:38] 5< 250-STARTTLS
[2020-06-11 11:57:38] 5< 250-ENHANCEDSTATUSCODES
[2020-06-11 11:57:38] 5< 250-8BITMIME
[2020-06-11 11:57:38] 5< 250-DSN
[2020-06-11 11:57:38] 5< 250 SMTPUTF8
[2020-06-11 11:57:38] 5> STARTTLS
[2020-06-11 11:57:38] 5< 220 2.0.0 Ready to start TLS
[2020-06-11 11:57:57] SSL/TLS connection using TLS1.2 (ECDHE-RSA/AES-256-GCM/AEAD)
[2020-06-11 11:57:58] 5> EHLO localhost
[2020-06-11 11:57:58] 5< 250-hwsrv-690473.poindexter.farm
[2020-06-11 11:57:58] 5< 250-PIPELINING
[2020-06-11 11:57:58] 5< 250-SIZE 10240000
[2020-06-11 11:57:58] 5< 250-VRFY
[2020-06-11 11:57:58] 5< 250-ETRN
[2020-06-11 11:57:58] 5< 250-AUTH PLAIN LOGIN
[2020-06-11 11:57:58] 5< 250-ENHANCEDSTATUSCODES
[2020-06-11 11:57:58] 5< 250-8BITMIME
[2020-06-11 11:57:58] 5< 250-DSN
[2020-06-11 11:57:58] 5< 250 SMTPUTF8
[2020-06-11 11:57:58] SASL local ip: 192.168.1.10;55794, remote ip:192.119.74.117;587
[2020-06-11 11:57:58] External SSF: 256
[2020-06-11 11:57:58] External authentication name: test
[2020-06-11 11:57:58] Authenticating (LOGIN)...
[2020-06-11 11:57:58] 5> AUTH LOGIN
[2020-06-11 11:57:58] 5< 334 VXNlcm5hbWU6
[2020-06-11 11:57:58] mutt_sasl_cb_authname: getting authname for poindexter.farm:587
[2020-06-11 11:57:58] 5> dGVzdA==
[2020-06-11 11:57:58] 5< 334 UGFzc3dvcmQ6
[2020-06-11 11:57:58] mutt_sasl_cb_pass: getting password for [email protected]:587
[2020-06-11 11:57:58] 5> dGVzdA==
[2020-06-11 11:57:58] 5< 235 2.7.0 Authentication successful
[2020-06-11 11:57:58] SASL protection strength: 0
[2020-06-11 11:57:58] SASL protection buffer size: 65536
[2020-06-11 11:57:58] 5> MAIL FROM:<[email protected]>
[2020-06-11 11:57:58] 5< 250 2.1.0 Ok
[2020-06-11 11:57:58] 5> RCPT TO:<[email protected]>
[2020-06-11 11:57:58] 5< 250 2.1.5 Ok
[2020-06-11 11:57:58] 5> RCPT TO:<[email protected]>
[2020-06-11 11:57:58] 5< 250 2.1.5 Ok
[2020-06-11 11:57:58] updating progress: 0K
[2020-06-11 11:57:58] Sending message... 0K/0.4K (0%)
[2020-06-11 11:57:58] 5> DATA
[2020-06-11 11:57:58] 5< 354 End data with <CR><LF>.<CR><LF>
[2020-06-11 11:57:58] 5> Date: Thu, 11 Jun 2020 11:57:38 -0500
[2020-06-11 11:57:58] 5> From: test account <[email protected]>
[2020-06-11 11:57:58] 5> To: [email protected], [email protected]
[2020-06-11 11:57:58] 5> Subject: test email
[2020-06-11 11:57:58] 5> Message-ID: <20200611165738.GA25828@localhost>
[2020-06-11 11:57:58] 5> MIME-Version: 1.0
[2020-06-11 11:57:58] 5> Content-Type: text/plain; charset=us-ascii
[2020-06-11 11:57:58] 5> Content-Disposition: inline
[2020-06-11 11:57:58] 5> User-Agent: Mutt/1.10.1 (2018-07-13)
[2020-06-11 11:57:58] 5> 
[2020-06-11 11:57:58] 5> sending a test email to check smtp certificate
[2020-06-11 11:57:58] 5> .
[2020-06-11 11:57:59] 5< 250 2.0.0 Ok: queued as CE28F82380
[2020-06-11 11:57:59] 5> QUIT
[2020-06-11 11:57:59] Mail sent.
[2020-06-11 11:57:59] mutt_free_body: unlinking /tmp/mutt-mini-odin-1001-25828-1671701897145424224.
[2020-06-11 11:59:08] mutt_index_menu[729]: Got op 151
[2020-06-11 11:59:08] Mailbox is unchanged.
[2020-06-11 11:59:08] Closing connection to hwsrv-690473.poindexter.farm...
[2020-06-11 11:59:08] 4> a0005 CLOSE
a0006 LOGOUT
[2020-06-11 11:59:08] 4< a0005 OK Close completed (0.000 + 0.000 secs).
[2020-06-11 11:59:08] 4< * BYE Logging out
[2020-06-11 11:59:08] Handling BYE
[2020-06-11 11:59:08] 4< a0006 OK Logout completed (0.000 + 0.000 secs).
[2020-06-11 11:59:08] IMAP queue drained
brad@mini-odin:~ $

postfix hostname configuration

brad@hwsrv-690473:/home/brad$ sudo postconf -d myhostname
[sudo] password for brad: 
myhostname = hwsrv-690473.poindexter.farm
brad@hwsrv-690473:/home/brad$

server hostname

brad@hwsrv-690473:/home/brad$ hostname
hwsrv-690473.poindexter.farm
brad@hwsrv-690473:/home/brad$ hostnamectl
   Static hostname: hwsrv-690473.poindexter.farm
         Icon name: computer-vm
           Chassis: vm
        Machine ID: a945a3535aa8484399fd888f61e31e6d
           Boot ID: 4e25349837c340e280e1060eff314f7c
    Virtualization: kvm
  Operating System: Debian GNU/Linux 9 (stretch)
            Kernel: Linux 4.9.0-3-amd64
      Architecture: x86-64
brad@hwsrv-690473:/home/brad$ cat /proc/sys/kernel/hostname
hwsrv-690473.poindexter.farm
brad@hwsrv-690473:/home/brad$

server /etx/postfix/main.cf

brad@hwsrv-690473:/home/brad$cat /etc/postfix/main.cf
# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
delay_warning_time = 1h

readme_directory = no

# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 2

# TLS parameters
#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_cert_file=/etc/letsencrypt/live/hwsrv-690473.poindexter.farm/fullchain.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_key_file=/etc/letsencrypt/live/hwsrv-690473.poindexter.farm/privkey.pem
smtpd_use_tls=yes
smtp_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = hwsrv-690473.poindexter.farm
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, poindexter.farm, localhost.farm, , localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all

# Mail will be stored in users' ~/Maildir directories
#
# NB: make sure to enforce this setting as well in the `mail_location`
# of /etc/dovecot/conf.d/10-mail.conf (thanks to Markus Hoffmann for
# pointing this out):
#
#     mail_location = maildir:~/Maildir
#
home_mailbox = Maildir/
mailbox_command =

# From http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
# SPF stuff

smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    reject_invalid_hostname,
    reject_unknown_recipient_domain,
    reject_unauth_destination,
    reject_rbl_client sbl.spamhaus.org,
    check_policy_service unix:private/policy-spf,
    check_sender_access hash:/etc/postfix/sender_access,
    check_recipient_access hash:/etc/postfix/recipient_access,
    permit
policy-spf_time_limit = 3600s
#
# DKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

brad@hwsrv-690473:/home/brad$
Improve this question
1
  • I'm having a terrible time posing my configs and outputs for more information for you to lookat
    – bradboy
    Jun 11, 2020 at 17:55

2 Answers 2

Reset to default
1

I knew that garethTheRed was on the right path, it's only logical that somewhere the hostname is different.

Changing the hostname on the server is not an option because I have other services running on it.

However, I decided to experiment more with .muttrc, and found a solution!

.muttrc line

#set smtp_url = "smtp://[email protected]:587/" # this did not work
set smtp_url = "smtp://[email protected]:587/" # this works

The first line, which is basically username@domain.name:port does not work.

The second line, which is username@server_hostname:port works like a charm!

Thanks, garethTheRed!

Improve this answer
1

You're mutt client is connecting to the SMTP server at smtp://[email protected]:587/, therefore the hostname is poidexter.farm. However, your Lets Encrypt certificate has a single Subject Alternate Name (SAN) extension containing a dnsName of hwsrv-690473.poindexter.farm. You can see this with:

echo "" | openssl s_client -connect poindexter.farm:587 -starttls smtp | openssl x509 -noout -text | grep -1 'Alternative Name'

The above command uses OpenSSL to act as a client (the openssl s_client -connect poindexter.farm:587 -starttls smtp) and connect to your server at poindexter.farm:587 at which point it pretends to be a SMTPS client (-starttls smtp). As part of the handshake, your server returns its certificate, which the command outputs amongst a multitude of other information. This data is piped (|) into another OpenSSL command (the openssl x509 -noout -text) which accepts a certificate (conveniently in the PEM format the previous command outputs), decodes it and outputs this as human readable text. Finally, this text output is piped (|) to grep (the grep -1 'Alternative Name') which filters for the phrase Alternative Name and outputs that and the next line (due to the -1). You can see the whole certificate by removing the last pipe and grep.

As you can see, the hostname you're accessing doesn't match the name in the certificate, hence the hostname does not match message.

You need to either configure DNS so that the mutt accesses the server using hwsrv-690473.poindexter.farm or get a new certificate with a SAN of poidexter.farm. That is, they should match.

Improve this answer
5
  • Thank you for suggestions! I have verified that I do have DNS MX and A records regarding the mail server. Added screenshot above. changed /etx/postfix/main.cg file smtpd_tls_cert_file and smtpd_tls_key_lines to the poindexter.farm certificate I already had for a different service. Also changed hostname from hwsrv-690474.poindexter.farm to just poindexter.farm now mutt errors with SASL authentication failed. This seems it went in a step in the wrong direction. restored to pre-change.
    – bradboy
    Jun 11, 2020 at 19:22
  • @bradboy - the bottom line still stands - if the hostname you use to access the service and the name in the certificate presented by said service differ, you will get the error. How you fix that is up to you, but until you do so, you'll continue to get the hostname does not match error.
    – garethTheRed
    Jun 11, 2020 at 20:13
  • I totally understand your logic, and it seems like such an obvious solution. I immediately tried it because it seemed like the answer. However, it made it worse to try it. The server's hostname, the entries in DNS, the certificate .pem, main.cf, .muttrc, even the certificate that mutt displays all show the exact same FQDN. Does mutt somehow cache certificates? Postfix? Is there a way that I can see exactly what FQDN is recorded in the certificate? I haven't found the right Google search terms to find the answer to those three questions. Lol, I'm with you, the solution seems simple.
    – bradboy
    Jun 11, 2020 at 20:30
  • added output above. could you please explain what it actually is, so I will know in the future?
    – bradboy
    Jun 11, 2020 at 21:03
  • @bradboy - I've edited the answer for you.
    – garethTheRed
    Jun 12, 2020 at 5:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .