2

I have two hosts, one with Debian Buster and one with CentOS 7.

I'd like to connect to an SMTP server over SSL from both of them. However, I can only do it from CentOS:

CentOS:

$ openssl s_client -connect smtp.server.com:587
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = server.com
verify return:1
---
Certificate chain
 0 s:/CN=server.com
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
...

Debian:

$ openssl s_client -connect smtp.server.com:587
CONNECTED(00000003)
depth=0 CN = server.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = server.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:CN = server.com
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
---

It seems that the issue is that the Debian host is missing a Let's Encrypt certificate or does not trust it.

How can I "transfer trust" from one machine to another? I.e. how can I ensure they both trust the same certificates?

1
1

Install CA Certificates Package

First of all, you need to confirm whether the Root CA certificates package is installed on your Debian box.

Run:

$ apt list --installed 2>/dev/null | grep ca-certificates

If the output has [installed] at the end of the line, then it is installed but the package is missing the Root CA certificate - jump to the next section.

If the command doesn't have output anything, then you'll need to install your CA certificates with:

$ sudo apt install ca-certificates

At this point, test your command again.

If it still fails, you'll need to add the Root CA certificate manually, as follows:

Add Root CA Certificate to the Trust-Anchor Store

If you read here you'll see that the correct Root is Let's Encrypt's ISRG Root X1. The Let's Encrypt issuing CA (Let's Encrypt Authority X3) has been signed by the above and also has been cross-signed by Identrust's Root CA in order to improve compatibility with older systems. It's the latter which your CentOS box is using, but that expires next year, so it's not worth installing in your Debian box.

To get your Debian machine working, download the Let's Encrypt ISRG Root X1 from the link above and save it to your Debian system as (for example) ISRG_Root_X1.pem to /usr/local/share/ca-certificates/

Make sure that you confirm that the link I've provided is genuine (a Let's Encrypt site) and secure (HTTPS), and not an attempt by me to have you install a forged Root CA certificate, before you continue to the next step.

Now run:

$sudo update-ca-certificates

to add the new certificate to your trust-store.

If you really want to use the Identrust Root CA certificate instead, you can download it from here. It's the last link on the page.

Try your command again and it hopefully should work.

Misconfigured SMTP Server

If it still fails, you need to check whether the SMTP server is sending the certificate chain as part of the TLS handshake. Quite often, server admins only configure the end-entity certificate and omit the CA chain. Add -showcerts to the command on the Debian box and check whether all the certs are shown (in PEM format).

If they're missing, speak to the server admins and ask them (nicely) to configure their server correctly.

2
  • Thanks! The ISRG_Root_X1 was already installed, so it looks like SMTP server is indeed misconfigured. I guess I'll have to settle with X3 for now. One correction: update-ca-certificates on debian does not recognize a path to a certificate file as a valid option. Instead, I had to modify /etc/ca-certificates.conf and then run update-ca-certificates without any options. – monday Jul 13 '20 at 17:53
  • 1
    @monday - thanks for spotting the error. You can actually add it to one specific directory so that there is no need to edit the config file. I've updated the answer. Looking at your question again, it seems that the misconfigured SMTP server is the culprit as there's no certificate being sent by the server other than it's own cert. – garethTheRed Jul 13 '20 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.