Configuré mi servidor de correo en mi servidor usando Postfix y dovecot. Los servidores SMTP e IMAP funcionan bien cuando se utilizan los comandos
openssl s_client -connect localhost:143 -starttls imap
y openssl s_client -connect localhost:25 -starttls smtp. Utilicé certificados Let's Encrypt. Pero cuando configuro las mismas credenciales en nexcloud siempre aparece el registroError al crear la cuenta: no se pudo abrir la conexión TLS segura al servidor.Sospecho que nextcloud no confía en mi certificado. Cuando desactivo TLS puedo autenticarme en Nexcloud
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = mail.example.com
verify return:1
---
Certificate chain
0 s:/CN=mail.example.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGWzCCBUOgAwIBAgISA0ajSksNknzQ2+R7wK9h1J2HMA0GCSqGSIb3DQEBCwUA
<TRUNCATE>
FMSZwZRGt2I1pTSafXsqRNzryHrc5ZQVgpsqHQnmGWnpg9I4Lv7glSg7dY+/bbE=
-----END CERTIFICATE-----
subject=/CN=mail.example.com
issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3955 bytes and written 450 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 309CFB94430523ABFC29179E5003A74CB332CDC4F6A975AFCCE12C3A45EC33D4
Session-ID-ctx:
Master-Key: ***
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
TLS session ticket lifetime hint: 3600 (seconds)
TLS session ticket:
0000 - 50 f3 2e 9a 1e 01 04 3c-86 8e f8 c7 f0 50 1a 3d P......<.....P.=
<TRUNCATE>
0090 - a4 93 ea 18 9e 0b 7b f1-2d 97 be cf fe 8b f3 4e ......{.-......N
Start Time: 1597921756
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
250 DSN
Para TLS en el lado de Postfix, configuro main.cf
#TLS
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_loglevel = 3
#smtpd_tls_received_header = yes
smtpd_tls_security_level = may
#smtpd_tls_auth_only = yes
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
tls_preempt_cipherlist = yes
tls_disable_workarounds = 0xFFFFFFFFFFFFFFFF
#smtpd_tls_mandatory_ciphers = high
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA
#smtpd_tls_dh1024_param_file = /etc/postfix/dhparam/dh1024.pem
#smtpd_tls_eecdh_grade = ultra
Respuesta1
STARTTLS se ejecuta cuando escribo mi host mail.example.com pero no funciona con localhost. Ejecuto este cliente de correo desde un subdominio cloud.example.com, parece que cloud.example.com no encuentra el host local mail.example.com