Certificate expired problem

Problem reported by Scott Wilson - 9/30/2021 at 11:55 PM

Submitted

I used the following KB article to create a cert and secure a SmarterMail instance and everything was fine until recently.

https://portal.smartertools.com/kb/a3466/securing-smartermail-with-lets-encrypt.aspx

When I run my server through a TLS tester it says the cert is expired even though I have tried renewing it repeatedly. Below is the output I'm getting from the script, I notice a number of lines that say "Missing stored keyset." Any idea what the problem could be?

C:\SmarterMail\Scripts>Powershell.exe -executionpolicy remotesigned -File c:\Sma
rterMail\Scripts\exportcert.ps1
MY "Personal"
================ Certificate 0 ================
Serial Number: xxxxxxxxxxxxxxxxx
Issuer: CN=R3, O=Let's Encrypt, C=US
NotBefore: 9/23/2021 2:55 PM
NotAfter: 12/22/2021 2:55 PM
Subject: CN=mail.example.com
Non-root Certificate
Cert Hash(sha1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Key Container = {00000000-0000-0000-0000-000000000000}
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Missing stored keyset
Encryption test passed
Missing stored keyset
Encryption test passed (CNG)
CertUtil: -exportPFX command completed successfully.
MY "Personal"
================ Certificate 1 ================
Serial Number: xxxxxxxxxxxxxxxxx
Issuer: CN=R3, O=Let's Encrypt, C=US
NotBefore: 8/24/2021 2:23 PM
NotAfter: 11/22/2021 2:23 PM
Subject: CN=mail.example.com
Non-root Certificate
Cert Hash(sha1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Key Container = {00000000-0000-0000-0000-000000000000}
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Missing stored keyset
Encryption test passed
Missing stored keyset
Encryption test passed (CNG)
CertUtil: -exportPFX command completed successfully.
MY "Personal"
================ Certificate 3 ================
Serial Number: xxxxxxxxxxxxxxxxx
Issuer: CN=R3, O=Let's Encrypt, C=US
NotBefore: 8/15/2021 10:53 AM
NotAfter: 11/13/2021 10:53 AM
Subject: CN=mail.example.com
Non-root Certificate
Cert Hash(sha1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Key Container = {00000000-0000-0000-0000-000000000000}
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Missing stored keyset
Encryption test passed
Missing stored keyset
Encryption test passed (CNG)
CertUtil: -exportPFX command completed successfully.
MY "Personal"
================ Certificate 4 ================
Serial Number: xxxxxxxxxxxxxxxxx
Issuer: CN=R3, O=Let's Encrypt, C=US
NotBefore: 9/30/2021 9:26 PM
NotAfter: 12/29/2021 9:26 PM
Subject: CN=mail.example.com
Non-root Certificate
Cert Hash(sha1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Key Container = {00000000-0000-0000-0000-000000000000}
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Missing stored keyset
Encryption test passed
Missing stored keyset
Encryption test passed (CNG)
CertUtil: -exportPFX command completed successfully.
MY "Personal"
================ Certificate 5 ================
Serial Number: xxxxxxxxxxxxxxxxx
Issuer: CN=R3, O=Let's Encrypt, C=US
NotBefore: 7/16/2021 10:52 AM
NotAfter: 10/14/2021 10:52 AM
Subject: CN=mail.example.com
Non-root Certificate
Cert Hash(sha1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Key Container = {00000000-0000-0000-0000-000000000000}
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Missing stored keyset
Encryption test passed
Missing stored keyset
Encryption test passed (CNG)
CertUtil: -exportPFX command completed successfully.

C:\SmarterMail\Scripts>pause
Press any key to continue . . .

10 Replies

Reply to Thread

Gabriele Maoret - SERSIS Replied

10/1/2021 at 12:13 AM

Do you use "Certify the web"?

You must update it to the latest version....

Gabriele Maoret - Head of SysAdmins at SERSIS Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)

Scott Wilson Replied

10/1/2021 at 12:19 AM

Yes, I use Certify the Web and tried updating to the latest version but still no luck.

Sabatino Replied

10/1/2021 at 1:50 AM

I thought so just in these days.
It would be very useful to insert in smartermail the certificate test in diagnostics and / or view the details of the certificates used

Validity, expiry etc.

Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy

Manuel Martins Replied

10/1/2021 at 4:23 AM

Hi,

I Had the same problem and the solution was as Gabriele Maoret said, just Update CertifytheWeb !

After that the Certificate was OK.

Gabriele Maoret - SERSIS Replied

10/1/2021 at 6:20 AM

@Scott Wilson: it's not enough to update "Certify the Web".

After that, you need to update the certificate also (open Certify the Web and re-issue the certificate request).

Sorry if I am not enough clear on that

Scott Wilson Replied

10/1/2021 at 8:05 AM

I went in and clicked the Request Certificate button on the specific cert, is that enough? Or do I need to delete the cert and start all over again?

Kyle Kerst Replied

10/1/2021 at 11:35 AM

Employee Post

This could be your Powershell script that exports the updated certificate to the PFX file. Have you run that manually?

Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com

Scott Wilson Replied

10/1/2021 at 12:12 PM

I ran it from Powershell itself instead of through the batch file but I'm not sure how that makes a difference. Interesting I still get the messages that say "Missing stored keyset" but when I run a TLS test it says the cert is now valid, okay as long as it works. The test does tell me I should also support TLS v1.3 as well, does SmarterMail support this? I haven't updated my instance for several months.

Karl Jones Replied

10/1/2021 at 4:10 PM

The problem was caused by the LetEncrypt root certificate expiring on 30 Sept 21. If users have certify the web installed then update the program and then update the certificate, even if it has time left before expiring. Once this has been done then there should be no further certificate expired errors, although it seems firefox on one of my clients refused to update despite clearing the cache and just presented a white screen when trying to log into smartermail webmail and still showed a failed SSL logon.

Gabriele Maoret - SERSIS Replied

10/1/2021 at 6:20 PM

You need to;

update "Certify the web"
request a new cetificate
run the Smartermail certificate script

after that everithing is ok

Back to Community Threads

Please leave this box unchecked

10 Replies

Reply to Thread

Tags

Related Knowledge Base Articles