1 Topic by dustinjohnson.2011

  • dustinjohnson.2011
  • Member
  • Offline
  • Registered: 2015-10-12
  • Posts: 1

Topic: No access after updating SSL

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.2
- Linux/BSD distribution name and version: Debian 8.1
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro? NO
====

I recently updated the ssl certificates for postfix,dovecot, and apache. I restarted all the services after doing so. I even restarted the server. Now I cannot connect via http to my linode. Everything was perfect up until i changed the ssl. Now no one can connect.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

If you don't tell us how you updated SSL, and what errors in log files, no one can help troubleshoot. So please go grab related logs and show us your upgrade steps.

3 Reply by quyhoang

  • quyhoang
  • Member
  • Offline
  • Registered: 2015-09-24
  • Posts: 48

Re: No access after updating SSL

dustinjohnson.2011 wrote:

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.2
- Linux/BSD distribution name and version: Debian 8.1
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro? NO
====

I recently updated the ssl certificates for postfix,dovecot, and apache. I restarted all the services after doing so. I even restarted the server. Now I cannot connect via http to my linode. Everything was perfect up until i changed the ssl. Now no one can connect.


Please show us our configuration files and steps. Maybe I can help you with that. smile

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

We have a tutorial to help you setup bought SSL certificate:
http://www.iredmail.org/docs/use.a.boug … icate.html

5 Reply by smshev (edited by smshev 2015-10-26 02:23:44)

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

Hi
SSL-customization guide is excellent, but part of the LDAP setup is not complete...
After i simply change the settings SLAPD-service also does not start. As a result - no access to the panel or to the mailboxes. After returning SSL settings for SLAPD to their original values service successfully started and access restored:
TLSCACertificateFile /etc/pki/tls/certs/server.ca-bundle
TLSCertificateFile /etc/pki/tls/certs/server.crt
TLSCertificateKeyFile /etc/pki/tls/private/server.key

As I understand it, we must also import information about the filenames of new certificates into the LDAP-schema. Can you complete this part of your guide?

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

smshev wrote:

After i simply change the settings SLAPD-service also does not start. As a result - no access to the panel or to the mailboxes. After returning SSL settings for SLAPD to their original values service successfully started and access restored:

What's the owner and permission of these SSL cert/key files?

smshev wrote:

As I understand it, we must also import new the certificates in the LDAP-scheme (to replace original certificates with own). Can you complete this a part of your guide?

There's no such "certificate in the LDAP-schema".

7 Reply by smshev (edited by smshev 2015-10-26 02:23:15)

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

ZhangHuangbin wrote:
smshev wrote:

After i simply change the settings SLAPD-service also does not start. As a result - no access to the panel or to the mailboxes. After returning SSL settings for SLAPD to their original values service successfully started and access restored:

What's the owner and permission of these SSL cert/key files?

My cert/key have :   -rw-r--r-- (root:root)
Apache, dovecot and postfix sucsessfully started and works with my certs/key.

ZhangHuangbin wrote:
smshev wrote:

As I understand it, we must also import new the certificates in the LDAP-scheme (to replace original certificates with own). Can you complete this a part of your guide?

There's no such "certificate in the LDAP-schema".

I corrected my original phrase. I wanted to say "... we must also import information about the filenames of new certificates into the LDAP-schema ..."

8 Reply by mir

  • mir
  • Member
  • Offline
  • Registered: 2014-05-30
  • Posts: 170

Re: No access after updating SSL

Your cert needs: -rw-r--r-- (root:root)
Your key needs: -rw-r----- (root ssl-cert)

9 Reply by smshev

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

I doubt
iRedMail.crt certificate is installed by default with such rights as I have. My certificate was originally rights 0600 (owners root: root). then I changed them in different combinations, but with my certificates SLAPD does not start.

This blog is not very fresh, but it is the most complete description of the actions of those that I have found:
http://rogermoffatt.com/2011/08/24/ubun … th-ssltls/

I have not tried this method, because I would like to get advice from the developers.

10 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

How about check old iRedMail cert/key files?
You can fix it with command 'chmod +r /path/to/cert' (or key)

11 Reply by smshev (edited by smshev 2015-10-27 02:14:24)

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

ZhangHuangbin wrote:

How about check old iRedMail cert/key files?
You can fix it with command 'chmod +r /path/to/cert' (or key)

With old (original) iRedMail cert/key files i have not any problems. I need set my own sert/key, but i cannot with your guide (only for SLAPD).
Can you help?

12 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

What's the error message when you restart OpenLDAP service?

13 Reply by smshev

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

root@server11:/etc/ldap# service slapd restart
Job for slapd.service failed. See 'systemctl status slapd.service' and 'journalctl -xn' for details.
root@server11:/etc/ldap# journalctl -xn | grep ldap
                                                  buildd@babin:/build/openldap-nFTO9j/openldap-2.4.40+dfsg/debian/build/servers/slapd
root@server11:/etc/ldap# journalctl -xn | grep slap
окт 27 08:16:03 server11 slapd[790]: DIGEST-MD5 common mech free
окт 27 08:16:03 server11 slapd[18100]: Stopping OpenLDAP: slapd.
окт 27 08:16:03 server11 slapd[18108]: @(#) $OpenLDAP: slapd  (Sep 11 2015 15:11:55) $
                                                  buildd@babin:/build/openldap-nFTO9j/openldap-2.4.40+dfsg/debian/build/servers/slapd
окт 27 08:16:03 server11 slapd[18108]: DIGEST-MD5 common mech free
окт 27 08:16:03 server11 slapd[18105]: Starting OpenLDAP: slapd failed!
окт 27 08:16:03 server11 systemd[1]: slapd.service: control process exited, code=exited status=1
-- Subject: Ошибка юнита slapd.service
-- Произошел сбой юнита slapd.service.
окт 27 08:16:03 server11 systemd[1]: Unit slapd.service entered failed state.
root@server11:/etc/ldap#

14 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

What's the error message if you start openldap manually like 'slapd -u openldap -g openldap -f /etc/ldap/slapd.conf -d 256'?

15 Reply by smshev (edited by smshev 2015-10-28 02:16:56)

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

ZhangHuangbin wrote:

What's the error message if you start openldap manually like 'slapd -u openldap -g openldap -f /etc/ldap/slapd.conf -d 256'?


here you are (see picture in attachment)

Post's attachments

pic1.JPG
pic1.JPG 37.96 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

16 Reply by mir

  • mir
  • Member
  • Offline
  • Registered: 2014-05-30
  • Posts: 170

Re: No access after updating SSL

You are sure that your certkey is not protected by a password?

17 Reply by smshev

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

mir wrote:

You are sure that your certkey is not protected by a password?

my apache, dovecot and postfix no need any password to start with my certificate

18 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

TLSCACertificateFile /etc/pki/tls/certs/server.ca-bundle
TLSCertificateFile /etc/pki/tls/certs/server.crt
TLSCertificateKeyFile /etc/pki/tls/private/server.key

*) Make sure all 3 files exist on the right place.
*) Try with permission 0700 first for testing, then set it to 0644.

19 Reply by smshev

  • smshev
  • Member
  • Offline
  • From: Russia
  • Registered: 2015-10-25
  • Posts: 29

Re: No access after updating SSL

ZhangHuangbin wrote:

TLSCACertificateFile /etc/pki/tls/certs/server.ca-bundle
TLSCertificateFile /etc/pki/tls/certs/server.crt
TLSCertificateKeyFile /etc/pki/tls/private/server.key

*) Make sure all 3 files exist on the right place.
*) Try with permission 0700 first for testing, then set it to 0644.

all ok but service not starts

20 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: No access after updating SSL

Sorry, there's a typo in my last reply. Please try file permission 0777, then 0644.

Default owner/group is "root:root", permission 0644.