I have just migrated a CWP installation from Centos 7 to AlmaLinux 9.4 by migrating the /home directory, the /var/vmail directory, and the databases.
All the features have been configured, but I have two problems that I have not yet managed to solve.
AlmaLinux 9.4 was installed with OpenSSL 3.0.7   1 Nov 2022 by CWP, and none of the programs, even a Laravel 11.x app under PHP 8.3.12, can send mail over port 465.  
Error message:

Connection could not be established with host "ssl://mail.example.com:465": stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed {"exception":"[object] (Symfony\\Component\\Mailer\\Exception\\TransportException(code: 0): Connection could not be established with host \"ssl://mail.example.com:465\": stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed at /home/user/laravel/vendor/symfony/mailer/Transport/Smtp/Stream/SocketStream.php:154)

I had to temporarily switch to using port 25 in the SMTP service.

The other problem is that postfix does not put DKIM signatures on the mails, even though all elements of the system, OpenDKIM, etc. are installed and running.
What should the config file of postfix and opendkim look like in CWP to get this service working properly?

On 10/17/2024 at 5:10 PM, TheHolbi said:

I have just migrated a CWP installation from Centos 7 to AlmaLinux 9.4 by migrating the /home directory, the /var/vmail directory, and the databases.
All the features have been configured, but I have two problems that I have not yet managed to solve.
AlmaLinux 9.4 was installed with OpenSSL 3.0.7   1 Nov 2022 by CWP, and none of the programs, even a Laravel 11.x app under PHP 8.3.12, can send mail over port 465.  
Error message:

Connection could not be established with host "ssl://mail.example.com:465": stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed {"exception":"[object] (Symfony\\Component\\Mailer\\Exception\\TransportException(code: 0): Connection could not be established with host \"ssl://mail.example.com:465\": stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed at /home/user/laravel/vendor/symfony/mailer/Transport/Smtp/Stream/SocketStream.php:154)

I had to temporarily switch to using port 25 in the SMTP service.

The other problem is that postfix does not put DKIM signatures on the mails, even though all elements of the system, OpenDKIM, etc. are installed and running.
What should the config file of postfix and opendkim look like in CWP to get this service working properly?

Maybe you haven't enabled smtps in your system.

Please, post your result from this command:

grep -P "^\s*(smtps|\-o\s*(syslog_name|smtpd_tls_wrappermode|smtpd_sasl_auth_enable|smtpd_relay_restrictions|smtpd_client_restrictions|smtpd_recipient_restrictions|milter_macro_daemon_name|smtpd_sasl_type|smtpd_sasl_path|content_filter|smtpd_proxy_filter))" /etc/postfix/master.cf

Regards,

Netino

Edited October 19Oct 19 by Netino

Hi @Netino The output is the following:

  -o content_filter=smtp-amavis:127.0.0.1:10024
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o content_filter= 
  -o content_filter=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o smtpd_client_restrictions=

 

The DKIM signature issue was resolved as follow:

There were missing lines from the /etc/postfix/main.cf :

#DKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

and the correct /etc/opendkim.conf was :

AutoRestart                Yes
AutoRestartRate        10/1h
LogWhy                      Yes
Syslog                         Yes
SyslogSuccess            Yes
Mode                          sv
Canonicalization        relaxed/simple
ExternalIgnoreList     refile:/etc/opendkim/TrustedHosts
InternalHosts             refile:/etc/opendkim/TrustedHosts
KeyTable                     refile:/etc/opendkim/KeyTable
SigningTable              refile:/etc/opendkim/SigningTable
SignatureAlgorithm  rsa-sha256
Socket                        inet:8891@localhost
PidFile                        /var/run/opendkim/opendkim.pid
UMask                       022
UserID                       opendkim:opendkim
TemporaryDirectory      /var/tmp

After completed /etc/postfix/main.cf and restarted services, the DKIM signature was properly inserted to the outgoing emails.

7 hours ago, TheHolbi said:

Hi @Netino The output is the following:

  -o content_filter=smtp-amavis:127.0.0.1:10024
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o content_filter= 
  -o content_filter=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o smtpd_client_restrictions=

 

You have two blank 'content_filter' lines, and two 'smtpd_client_restrictions' lines, one with 'permit_sasl_authenticated,reject' and the other blank.

But the 'smtpd_client_restrictions' lines seems to have a contradiction. The first is being overridden by the second (if it is not belonging to another section).

Below are a suggestion for the configuration of the 'smtps' section. Some configurations may be identical to the submission, this is because one configuration is for sending and the other for receiving. Since we will only use service ports that require authentication, they can be identical:

smtps     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

"-o syslog_name=postfix/smtps" indicates that the activities will be available under the name “postfix/smtps” in the log file.

"-o smtpd_tls_wrappermode=yes" indicates that TLS Fallback will be used for email clients that do not support STARTTLS.

"-o smtpd_sasl_path=private/auth" The authentication format that will be passed to the SASL plugin. This configuration must match the socket file '/var/spool/postfix/private/auth'.

"-o smtpd_client_restrictions=permit_sasl_authenticated,reject" The types of requests that will be accepted from clients.

"-o milter_macro_daemon_name=ORIGINATING" The name of the email filter process macro.

Check the existance of your socket file in /var/spool/postfix/private/auth.

Check too if you opened the port 465 in your firewall.
And check too if your certificates are valid an being pointed and used in '/etc/postfix/vmail_ssl.map' file.

Edited October 20Oct 20 by Netino