Quote From : CosmicDebri November 19, 2015, 6:32 am Well, I had trouble adding a domain, it kept redirecting to my primary domain. Somehow I figured out it was due to a bad/corrupt ssl certificate record. I had deleted my installed certs, and the domain started working, but I guess the email was looking for them and they weren't there. I reinstalled my startssl cert, and now the email seems to connect with tls, still not with ssl, but I'll take the tls for now.
Now I get the very common issue of all mail sent from my Webuzo domains to gmail going into spam folder. I realize this is likely due to no reputation, etc, but still a major pain in the ass.
Last thing I'll try is trying to find where Webuzo puts the certs (if anyone knows, please let me know) and try editing exim configs to look for them in the right place. If I can't get that to work and stop sending emails to google's spam folders, I'll just stick with sending smtp through SendGrid, it all gets thru from there. They manage their blacklisting and reputations pretty well it looks like.
Hi CosmicDebri,
you are very near the solution of your issue.
First,
if your certificate is StartSSL COM I think I have found an issue with that certificate in Webuzo.
PLEASE BACKUP ALL FILES YOU WILL EDIT following this guide. Can be user full is something go wrong. This guide is at your risk.
Please follow this step to fix this issue and let me know if you are able to find the error i Will tell you. If the reply are affirmative Wenbuzo have to work on this BUG because will sure is a problem maybe with Webuzo or START SSL COM certificate.
Your email for use your certificate need to have a valid .pem file. This .pem file are generated when you install a certificate (from Webuzo).
I have discover in my case this file is generated corrupted so that is why email not works but maybe also after this fix StartSSL COM can not be valid for email I don't know why. Let's try check and fix your generated .pem file and maybe fix it.
Please go to /etc/ssl/cert
here you should file .pem file of the domain where you setup the SSL.
If you are from SSH do this command:
vi ./yourcertificatename.pem
you will see many codes inside the certificate, use the down arrow on your keyboard for scroll down the page and continue to look into the file.
By scrolling dow check if you see a row like this:
-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----
if you found that this is the error of the .pem file so you should press the letter I (Insert) in your keyboard and go head on the 5° (-) so the correct form of this row will be in two row like this:
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
so just replace the one row with this two and than save :wq
after that you need check if exim and dovecot are well configured for work with SSL.
Let's do together.
root > cd
/etc/exim/
root > vi ./exim.conf
I suggest to copy the two row
ssl_cert = </etc/ssl/certs/cert.pem
ssl_key = </etc/ssl/private/cert.key
and past under than comment the first two row copied so edit the two pasted row so you will have
#ssl_cert = </etc/ssl/certs/cert.pem
#ssl_key = </etc/ssl/private/cert.key
ssl_cert = </etc/ssl/certs/certSSL.pem
ssl_key = </etc/ssl/private/certSSL.pem
here you have to edit the two TLS row and put your .pem file patch of the certificate
so cert.pem you have to replace in the not commented row with your file name .pem
where certSSL.pem will be your cert name file. As you can see i replaced .key file also with .pem file
after :wq for save
after that you need edit dovecot conf
you need open port 995:
Root > cd/etc/dovecot/conf.d
Root > vi./10-ssh.conf
and
change SSL/TLS from no to yes
for change that press I of Insert "on
the keybord" and edit no to yes then press esc "on the keybord", now digit
:wq and press enter
Root > service dovecot restart
Now you should check if port 995 is open, you can do it here:
http://www.infobyip.com/tcpportchecker.php
Also check if port 465 is opened.
If 465 still close please do the following command:
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
now test again and 465 will be opened, 995 should be opened without a iptables command.
Now you can test if all works fine, if not can be the STARTS SSL issue so maybe suggest to use STARTTLS and not SSL
-----------------------
PeopleInside 
Web, security, open source passionate.
|
Powered By AEF 1.0.8 © 2007-2008 Electron Inc.
