V15.5 MailKit won't talk to Zimbra with Lets Encrypt

[Mike Hammett]

Likely the same problem as this thread (https://www.3cx.com/community/threa...nnot-connect-to-my-postfix-smtp-server.59443/) but that thread is closed, so I can't see if anyone else has any ideas.

I have Let's Encrypt providing the certificates for my Zimbra (backed by Postfix) environment.

https://www.checktls.com/TestReceiver gives me all passes and correctly identifies the cert chain.

A friend of mine uses Lets Encrypt on his Zimbra and he has never had a problem with a client.

An error occurred while attempting to establish an SSL or TLS connection. The SSL certificate presented by the server is not trusted by the system for one or more of the following reasons: 1. The server is using a self-signed certificate which cannot be verified. 2. The local system is missing a Root or Intermediate certificate needed to verify the server's certificate. 3. The certificate presented by the server is expired or invalid. See https://github.com/jstedfast/MailKit/blob/master/FAQ.md#InvalidSslCertificate for possible solutions.

How can we fix this?

 

[cobaltit]

It's unclear what you are trying to fix. Can you not receive emails sent via 3CX SMTP or are you trying to use your own server as the SMTP server? If the latter is that the error message you are getting in 3CX when you click test because I don't recall ever seeing that error text.

 

[StefanW]

Hello Mike,

we looked into this and found with another customer, that the revocation list check for some certs returns false as they cannot be checked. The result is an TLS trust issue. Oddly, using the same code and destination, on windows it works. We extended the code in the upcoming v16 Beta 1 that "no result" is trusted, only explicit revokes show the same result. Once the beta is out, check it out and let us know.

 

[Mike Hammett]

@StefanW
So 15.5 for Linux has this problem, but 15.5 for Windows does not? 16 for Linux has a workaround for the problem?

@cobaltit This is when trying to use my own SMTP server instead of the 3CX SMTP server. I do get it when clicking test.

 

[StefanW]

it appear only to be on Linux only in v15.5, v16.0 Beta 1 (upcoming soon) will have it "addressed" in both versions.

 

[Mike Hammett]

Is there any way to specify an alternate port for the 3CX mail client to try using? I don't want to allow plaintext or unauthenticated logins everywhere. It seems like Postfix would allow me to accept mail for relay from a specific prefix on an alternate port.

 

[Mike Hammett]

Found it here: https://www.3cx.com/community/threads/proper-way-of-specifying-port-for-smtp.39489/#post-162307