<div dir="ltr"><div>Hi Hede!<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 7, 2020 at 5:38 AM hede <<a href="mailto:kolab983@der-he.de">kolab983@der-he.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Am 04.01.2020 23:31, schrieb Hernan Saltiel:<br>
> [...]<br>
> I'm using Kolab 16, and some time ago some certificate expired, so<br>
> when our Outlook users open their mail client, a message stating that<br>
> the certificate has expired appears.<br>
> I was re-reading the installation process, and I'm really confused<br>
> about which certificate do I need to recreate, and how.<br>
> Please, if somebody had an issue like this one, let me know how to<br>
> deal with it. [...]<br>
<br>
If it's Outlook it's either imap, smtp or http (activesync) or any <br>
combination of those.<br>
<br>
At first you have to consider either to use a self signed certificate or <br>
a regular CA certificate. The first one will always trigger warnings and <br>
as such the later one is quite common. Here you can either buy a <br>
certificate (from your next SSL certificate dealer) or simply use Let's <br>
Encrypt, which is free of charge. There are plenty of guidances how to <br>
create self signed or Let's Encrypt certificates, use your favorite <br>
search engine to find those:<br>
<br>
- <a href="https://duckduckgo.com/?q=openssl+create+certificate&t=h_&ia=web" rel="noreferrer" target="_blank">https://duckduckgo.com/?q=openssl+create+certificate&t=h_&ia=web</a><br>
- <a href="https://duckduckgo.com/?q=let%27s+encrypt+getting+started&t=h_&ia=web" rel="noreferrer" target="_blank">https://duckduckgo.com/?q=let%27s+encrypt+getting+started&t=h_&ia=web</a><br>
<br>
Then, if the certificate is installed and ready to use at your server, <br>
change the corresponding config files to point to your new SSL <br>
certificates and keys. Let's say you have the following files:<br>
<br>
1. Key: /etc/certbot/privkey.pem<br>
2. Cert: /etc/certbot/cert.pem<br>
3. Cert+Intermediates: /etc/certbot/fullchain.pem<br>
4. Cert+Intermediates+Key: /etc/certbot/fullchainandkey.pem<br></blockquote><div><br></div><div>I do not have the certbot directory, what I have is a self signed certificate, that expired. The Outlook window do not state that the certificate is invalid because it's self signed, but because has expired. <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
(The last one is uncommon with certbot defaults and not needed by <br>
default, but it's simply created by "cat"ing 1. and 3.; the default path <br>
for cerbot includes the domain which is unknown to me and as such I have <br>
not included it in the examples here. You have to change your pathes <br>
accordingly.)<br>
<br>
Then you have to edit the following files and values:<br>
<br>
/etc/postfix/<a href="http://main.cf" rel="noreferrer" target="_blank">main.cf</a><br>
####<br>
smtpd_tls_cert_file=/etc/certbot/fullchain.pem<br>
smtpd_tls_key_file=/etc/certbot/privkey.pem<br>
submission_tls_cert_file = /etc/certbot/fullchain.pem<br>
submission_tls_key_file = /etc/certbot/privkey.pem<br>
smtp_tls_cert_file = /etc/certbot/fullchain.pem<br>
smtp_tls_key_file = /etc/certbot/privkey.pem<br>
####<br>
<br>
/etc/imap.conf (needed esp. if guam is not used)<br>
####<br>
tls_server_cert: /etc/certbot/fullchain.pem<br>
tls_server_key: /etc/certbot/privkey.pem<br>
####<br>
<br>
/etc/apache2/sites-enabled/default-ssl.conf (or any other apache ssl <br>
config)<br>
####<br>
SSLCertificateFile /etc/certbot/fullchain.pem<br>
SSLCertificateKeyFile /etc/certbot/privkey.pem<br>
####<br></blockquote><div><br></div><div>All this was previously configured, when initially installed the server, with the certs I created. <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
/etc/guam/sys.config<br>
you must edit the file at two places: sections imaps (port 993, <br>
implicit_tls) and imap (port 143, starttls)<br>
####<br>
[...]<br>
tls_config, [<br>
{ keyfile, "/etc/certbot/privkey.pem" },<br>
{ certfile, "/etc/certbot/cert.pem" },<br>
{ cacertfile, "/etc/certbot/fullchain.pem" },<br>
[...]<br>
]<br>
[...]<br>
####<br>
<br>
If you have installed ejabberd:<br>
/etc/ejabberd/ejabberd.yml<br>
####<br>
certfiles:<br>
- "/etc/certbot/fullchainandkey.pem"<br>
####<br>
<br>
Have I forgotten something?<br></blockquote><div><br></div><div>Thanks a lot for all this explanation, what I need is to understand the procedure to renew the certificates, not only to initially install the server certificates, because it's already installed, and was working properly until some time ago, that the certificate expired, and started to give me that kind of messages on the Outlook clients. <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
regards<br>
hede<br></blockquote><div><br></div><div>Thanks, and best regards, <br></div></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature">HeCSa</div></div>