MailServer ssl certificate not full chaining.

aaP_alin_rzv

Mailserver 5.7 , OS Ubuntu 22.04.5 LTS

When signing the certificate / ssl from the mailserver interface it doesn't generate full chain pem file,missing letsencrypt cert on chain or smth ?, so my php script (laravel framework) fails to send because it cannot validate the ssl, i had to copy the pem and key of my website from the website section instead, so i can make it work, it needs to be fixed !!

This loggs in the mailserver when the php is triggering to send the e-mail.

Jan 10 08:14:54 vmi238***** postfix/submission/smtpd[118103]: connect from vmi238*****.*****server.net[*****]
Jan 10 08:14:55 vmi238***** postfix/submission/smtpd[118103]: SSL_accept error from vmi238*****.*****server.net[*****]: -1
Jan 10 08:14:55 vmi238***** postfix/submission/smtpd[118103]: warning: TLS library problem: error:0A000418:SSL routines::tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c:1593:SSL alert number 48:
Jan 10 08:14:55 vmi238***** postfix/submission/smtpd[118103]: lost connection after STARTTLS from vmi238*****.*****server.net[*****]
Jan 10 08:14:55 vmi238***** postfix/submission/smtpd[118103]: disconnect from vmi238*****.*****server.net[*****] ehlo=1 starttls=0/1 commands=1/2

And the error from the php controller which handles the connection says

Unable to connect with STARTTLS: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

aaPanel_Kern

https://www.aapanel.com/docs/Function/Tutorial/Mail_SMTP_configuration.html
Hello, please refer to this tutorial to check whether the domain name of the SSL certificate contains an A record?

aaP_alin_rzv

aaPanel_Kern

The validation is done automatically by Cloudflare api , i have it connected , and yes it does have an A RECORD added to the domain dns entries.

aaP_alin_rzv

aaPanel_Kern I know you must have read only the errors , the problem is with the signing certificate from the Mailserver interface , i had grabbed the pem and key of my website ( from the website list > ssl link) and put them manually in the Other SSL section of that domain added on the mailserver so i can get it to work, the signing process is broken from the Mailserver Interface ...

aaP_alin_rzv

aaPanel_Kern

aaP_alin_rzv

check whether the domain name of the SSL certificate contains an A record

aaP_alin_rzv

I have told you that i have the certificate manually setup from my website which is signed just fine and is working with that , the domain in the mailserver is the same .

The SSL pem in the one generated from the MailServer interface has only 2kb /www/server/panel/plugin/mail_sys/cert/to*****my.ro/fullchain.pem

And the one signed from the website section has 4kb .. meaning is full chain pem .

I asked ChatGPT to check the pem generated from the MailServer

I'll analyze your uploaded PEM file to determine if it contains the full chain.

The provided PEM file contains only 1 certificate.

This suggests that the file does not contain the full chain, as a full chain typically includes:

The domain's certificate (leaf certificate).
One or more intermediate certificates linking the domain's certificate to the root.
If you intend to provide a full chain, you may need to append the necessary intermediate certificates to the PEM file.

aaPanel_Kern

Hello, you can apply for the corresponding pan-domain SSL certificate from the website and then copy it to the mail server. Will it work normally?

aaP_alin_rzv

Also i forgot to mention, i am using the latest aapanel version 7.0.13.