If I don’t need any of the advanced things, then I do not need to use the POSTCONF_smtpd_tls... variables, right? The website is of course https.

If it started last November, that’s almost certainly the Let’s Encrypt root certificate expiry. You should just need to pull the new image and rebuild. [image] Self-hosted mail-receiver update following Let's Encrypt root certificate change Self-hosting This announcement only affects self-hosters who are running Configure direct-delivery incoming email for self-hosted sites with Mail-Receiver. Managed hosting customers, and self-hosters using POP3 for incoming mail are not affected. As you may be aware, Let’s Encrypt recently changed their root certificate. The old root certificate expired today, and has caused a number of issues for out-of-date clients across the web. All of our systems at CDCK are up-to-date, and were not affected by today’s…

You won’t need the variations above but you will still need the TLS config found in samples/mail-receiver.yml, modified for your domain name, in order to support TLS encryption. Assuming you’re using the Let’s Encrypt template for https, the lines from the sample just need to be uncommented with the domain name replaced.

hm, then any ideas why it stopped working recently, showing this error about certificates? Oct 6 19:18:27 receive-mail[94]: Failed to POST the e-mail to https://www..../admin/email/handle_mail: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError) Oct 6 19:18:27 receive-mail[94]: /usr/local/lib/ruby/2.3.0/net/protocol.rb:44:in `connect_nonblock' /usr/local/lib/ruby/2.3.0/net/protocol.rb:44:in `ssl_socket_connect' /usr/local/lib/ruby/2.3.0/net/http.rb:928:in `connect' /usr/local/lib/ruby/2.3.0/net/http.rb:863:in `do_start' /usr/local/lib/ruby/2.3.0/net/http.rb:852:in `start' /usr/local/lib/ruby/2.3.0/net/http.rb:1384:in `request' /usr/local/lib/ruby/site_ruby/mail_receiver/discourse_mail_receiver.rb:42:in `process'

Well the error is showing that it has received an email and is failing to verify the certificate trying to connect to your Discourse instance. This tells us that the issue isn’t with something else connecting to your mail receiver, though not necessarily that TLS is working. (The email may have been delivered without TLS) It’s hard to tell what might be happening just from that but if you go to https://www.... (domain exactly as it appears in the error message) in your browser, does it connect successfully? If it does, this probably suggests your mail receiver doesn’t trust it for some reason. If it doesn’t, this may suggest something wrong with the SSL setup in app.yml (e.g. only getting a certificate for example.com and not www.example.com) or something wrong with the Discourse URL in mail-receiver.yml (e.g. using www.example.com when it should just be example.com).

https://www.programmersforum.rocks No changes in the domain or anything, the site works fine. Actually the logs show that it started last November, but still there were no changes.

Ok, so that certificate is perfectly fine. Tell us more about the mail server that connects to your forum. Is it a regular mail-receiver docker container?

[image] Alex P.: https://www.programmersforum.rocks [image] Richard - Communiteq: Ok, so that certificate is perfectly fine. I checked it with //email/testTo: ; if you want to see for yourself, that’s a way to test. As Richard suggests, the problem does not appear to be with Discourse the email receiver.

[image] Jay Pfaffman: As Richard suggests, the problem does not appear to be with Discourse the email receiver. No, I think the issue is between the email receiver and Discourse. Discourse is public facing so I was able to check Discourse’s certificate and see that it was fine. So my suspicion is that it is on the email receivers end.

[image] Simon Manning: If it started last November, that’s almost certainly the Let’s Encrypt root certificate expiry. That sounds like a good possibility! [image] Richard - Communiteq: No, the issue is between the email receiver and Discourse. Agreed, but Simon’s explanation might explain the issue with whatever is connecting to the mail receiver. EDIT: If it’s possible that the problem started last November but was noticed only recently.

[image] Simon_Manning: If it started last November [image] Alex P.: it stopped working recently :thinking: …

Incoming mail server has certificate error

Product Support Self-hosting

pfaffman (Jay Pfaffman) October 6, 2022, 8:39pm 5

If you would include your hostname then we could help more.

Have you changed the domain name of your site? Is the certificate correct on the site?

Has anything else changed on the site in the past 90 days?

Topic		Replies	Views
Possible bug with mail: certificate verify failed (unable to get local issuer certificate) Self-hosting	5	757	December 27, 2023
Hostname doesn't match server certificate (Let's Encrypt) Self-hosting	2	1679	December 20, 2018
Discourse setup completed successfully but not working due to SSL error Product Support	6	504	December 18, 2024
Issue with mail-receiver and self-signed certificate? Self-hosting mail-receiver	3	624	May 31, 2023
Emails not working after upgrade: certificate verify failed Self-hosting	1	1326	May 13, 2022

Incoming mail server has certificate error

Related topics