TLS installation

[FlorinBuffet]

Hi there
I don't use caddy for certificate generation. I exported a valid certificate for postal.mydomain.ch from NPM.
Then i uploaded the two files "cert1.pem" and "privkey1.pem" to the /opt/postal/config folder and updated the postal.yam file:

smtp_server:
  default_bind_address: "::"
  tls_enabled: true
  tls_certificate_path: /config/cert1.pem
  tls_private_key_path: /config/privkey1.pem

Unfortunatly it doesn't work. On checktls.com i get this error:
´´´
Certificate 1 of 1 (sent by MX):
Cert VALIDATION ERROR(S): unable to get local issuer certificate
This may help: What Is An Intermediate Certificate
So email is encrypted but the recipient domain is not verified
´´´

In the logs i got this:

<= EHLO ssl-tools.net trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  => 250-My capabilities are trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  => 250-STARTTLS trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  => 250 AUTH CRAM-MD5 PLAIN LOGIN trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  <= STARTTLS trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  => 220 Ready to start TLS trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  SSL Negotiation Failed: SSL_accept returned=1 errno=0 peeraddr=[::ffff:168.119.147.146]:50736 state=error: no shared cipher trace_id=DVPLSBZZ component=smtp-server
2025-01-09 17:56:41 +0000 DEBUG  Connection closed trace_id=DVPLSBZZ component=smtp-server
2025-01-09 18:16:18 +0000 DEBUG  Client identified as 142.93.73.156 trace_id=FQJXGWBN component=smtp-server

How could i fix this? Unfortunatly googling the error did not provide me any help.

Of course as soon as this works i'd update the documentation if needed.

[willpower232]

I exported a valid certificate for postal.mydomain.ch from NPM

unable to get local issuer certificate

I'm not sure what NPM is but I would assume one of the following is true

• it isn't trusted everywhere
• you need to include some kind of "full chain" instead of just the certificate
• there is some kind of bug with checktls.com

[FlorinBuffet]

The certificate is from Nginx Proxy Manager and definitely valid, as i can open the web interface and have a valid certificate there...
But i'll try with the full chain.