ERROR: error reading: received fatal alert: UnknownCA

get-help
41

https://docs.kumomta.com/tutorial/system_preparation/?h=certi#creating-a-self-signed-certificate

42

and that’s fine (like I’m familiar enough with the concept I might be able to figure it out) but wanted to let you know those instructions I THINK Are incomplete?

43

You are only halfway there. The csr and key create the cert

44

…I figured it out.

45

Looking

46

the instructions are complete I just missed something

47

mv -f ca.crt /etc/pki/tls/certs

48

that’s my cert

49

so I just need to add /etc/pki/tls/certs to my kumo.start_esmtp_listener

50

Perfect.

51

trying now

52

I need to be AFK for a bit but will answer any new comments as soon as I am back

53

I appreciate that, sorry it was such a silly oversight

54

got confused betwen .crt/.pem/certs

55

well that’s progress

56 
[x.x.x.x:29299->y.y.y.y:25] 131ms  -> STARTTLS
[x.x.x.x:29299->y.y.y.y:25] 131ms <-  220 Ready to Start TLS
[x.x.x.x:29299->y.y.y.y:25] 265ms === ERROR: Peer Disconnected```
57

so THAT could be that their server doesn’t like the self-signed certificate

58

Yeah, that is what I was starting to say above. They are complaining about your cert (or lack thereof)

59 

This usually means that the SSL certificate presented by the server is not trusted by the system for one or more of
the following reasons:

1. The server is using a self-signed certificate which cannot be verified.
2. The local system is missing a Root or Intermediate certificate needed to verify the server's certificate.
3. A Certificate Authority CRL server for one or more of the certificates in the chain is temporarily unavailable.
4. The certificate presented by the server is expired or invalid.
5. The set of SSL/TLS protocols supported by the client and server do not match.

See https://github.com/jstedfast/MailKit/blob/master/FAQ.md#ssl-handshake-exception for possible solutions.

there we go. perfect

60

so 2 issues (incase anyone else searches and finds this):

  1. if you’re following the self-signed certificate instructions and the esmtp_listener instructions, realize that the .pem file would actually be your /etc/pki/tls/certs file
  2. some injectors don’t allow self-signed certificates