Mercury 4.8 Certificate Replacement Woes

Tim W Young

posted May 9 '19 at 5:40 am

I think you missed the message previous to yours, where the solution was posted.

I think you missed the message&nbsp;<span style="font-size: 13.3333px;">previous&nbsp;to yours,</span>&nbsp;where the solution was posted.

cretson

posted Jan 10 '19 at 4:16 pm

I had been using a self-signed security certificate for the past 2 years, realized that it expired (whoops). I purchased a proper certificate, and set it up on Mercury (replacing the .PEM with the .CRT on the config screen for each module's SSL). But, mail clients are still reporting the expired certificate!

(Thinking maybe it was not liking the format of the third-party certificate...) I tried creating a new self-signed cert using Mercury's built-in tool, but found it wasn't creating the file as it says it was doing! I thought maybe my install was corrupt or obsolete (I have been upgrading since I first installed Mercury on Windows 98, now on Windows 10), so tried creating a second, clean installation of Mercury in another folder, ran the tool to create a self-signed certificate, but got the same result (says a certificate file was created, but it's not there).

Anybody else on Windows 10 / Mercury 4.8, tried making self-signed certificate and had it work (that is, produce the desired file)?

Any other thoughts on why Mercury would still be distributing the certificate I thought replaced?

Can I manually find the text version of the key somewhere to confirm it took? I tried removing the old certificate from the folder, but it still is distributing the old cert, so I assume it must copy the certificate into the config files somewhere?

About ready to lose my mind, any insight would be helpful!

<p><span style="font-size: 10pt;">I had been using a self-signed security certificate for the past 2 years, realized that it expired (whoops).&nbsp;&nbsp;</span><span style="font-size: 10pt;">I purchased a proper certificate, and set it up on Mercury (replacing the .PEM with the .CRT on the config screen for each module's SSL).&nbsp; <b>But, mail clients are still reporting the expired certificate!&nbsp;</b></span></p><p><span style="font-size: 10pt;">(Thinking maybe it was not liking the format of the third-party certificate...) I tried creating a new self-signed cert using Mercury's built-in tool, but found <b>it wasn't creating the file as it says it was doing</b>!&nbsp; I thought maybe my install was corrupt or obsolete (I have been upgrading since I first installed Mercury on Windows 98, now on Windows 10), so tried creating a second, clean installation of Mercury in another folder, ran the tool to create a self-signed certificate, but got the same result (says a certificate file was created, but it's not there).</span></p><p>Anybody else on Windows 10 / Mercury 4.8, tried making self-signed certificate and had it work (that is, produce the desired file)?&nbsp; </p><p><span style="font-size: 10pt;">Any other thoughts on why Mercury would still be distributing the certificate I thought replaced?&nbsp;</span></p><p>Can I manually find the text version of the key somewhere to confirm it took?&nbsp; I tried removing the old certificate from the folder, but it still is distributing the old cert, so I assume it must copy the certificate into the config files somewhere?</p><p>About ready to lose my mind, any insight would be helpful!&nbsp;</p>

cretson

posted Jan 11 '19 at 4:00 am

Update: the old key seems to have gone away on its own - maybe it was cached somewhere and finally refreshed. But TLS still not working.

Did a session log, saw this error:

21:43:00.726: << * OK d IMAP4rev1 Mercury/32 v4.80.145 server ready.<cr><lf>

21:43:00.773: >> 1 CAPABILITY<cr><lf>

21:43:00.773: << * CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED X-MERCURY-1<cr><lf>

21:43:00.773: << 1 OK CAPABILITY complete.<cr><lf>

21:43:00.836: >> 2 STARTTLS<cr><lf>

21:43:00.836: << 2 OK Begin SSL/TLS negotiation now.<cr><lf>

21:43:00.976: [!] OpenSSL reported errors during handshake - error queue follows:

21:43:00.976: [!] -------------------------------------------------------------------------

21:43:00.976: [!] error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher

21:43:00.976: [!] -------------------------------------------------------------------------

What am I doing wrong here? Thanks!

<div>Update: the old key seems to have gone away on its own - maybe it was cached somewhere and finally refreshed.&nbsp; But TLS still not working.</div><div>&nbsp;</div><div>Did a session log, saw this error:</div><div>&nbsp;</div><div>21:43:00.726: &lt;&lt; * OK d IMAP4rev1 Mercury/32 v4.80.145 server ready.&lt;cr&gt;&lt;lf&gt;</div><div>21:43:00.773: &gt;&gt; 1 CAPABILITY&lt;cr&gt;&lt;lf&gt;</div><div>21:43:00.773: &lt;&lt; * CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED X-MERCURY-1&lt;cr&gt;&lt;lf&gt;</div><div>21:43:00.773: &lt;&lt; 1 OK CAPABILITY complete.&lt;cr&gt;&lt;lf&gt;</div><div>21:43:00.836: &gt;&gt; 2 STARTTLS&lt;cr&gt;&lt;lf&gt;</div><div>21:43:00.836: &lt;&lt; 2 OK Begin SSL/TLS negotiation now.&lt;cr&gt;&lt;lf&gt;</div><div>21:43:00.976: [!] OpenSSL reported errors during handshake - error queue follows:</div><div>21:43:00.976: [!] -------------------------------------------------------------------------</div><div>21:43:00.976: [!] error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher</div><div>21:43:00.976: [!] -------------------------------------------------------------------------</div><div>&nbsp;</div><div>What am I doing wrong here?&nbsp; Thanks!&nbsp;</div>

Sellerie

posted Jan 11 '19 at 8:23 pm

Removing the old cert from the folder is not enough, you have to restart mercury.

Thomas Gohel

posted Jan 12 '19 at 11:06 am

[quote user="cretson"]Update: the old key seems to have gone away on its own - maybe it was cached somewhere and finally refreshed. But TLS still not working. [/quote]

What exactly goes wrong with you, I can not say that either. I am using a certificate from LetsEncrypt and it works without problems. I see sometimes the SSL error message in the logfile too, but this is almost always a SSL test server.

A tip maybe: The Mercury SSL libraries are ancient. You should simply replace the two SSL-files with current ones [;)].

<p>[quote user="cretson"]Update: the old key seems to have gone away on its own - maybe it was cached somewhere and finally refreshed.&nbsp; But TLS still not working. [/quote]</p><p>&nbsp;</p><p><span class="tlid-translation translation"><span title="" class="">What exactly goes wrong with you, I can not say that either. </span></span><span class="tlid-translation translation"><span title="" class="">I am using a certificate from LetsEncrypt and it works without problems. I see sometimes the SSL error message in the logfile too, but this is almost always a SSL test server.</span></span> </p><p>&nbsp;</p><p><span class="tlid-translation translation"><span title="" class="">A tip maybe: The Mercury SSL libraries are ancient.</span> <span title="">You should simply replace the two SSL-files with current ones [;)].</span></span></p>

cretson

posted Jan 12 '19 at 3:02 pm

Thanks for the feedback! I reached out to the issuing company, and they built me a .PEM with the private/public keys just as I'd done, but used a different keys (I think they re-issued my key). Using that, I started getting a different error:

08:33:55.008: [!] OpenSSL reported errors during handshake - error queue follows:

08:33:55.008: [!] -------------------------------------------------------------------------

08:33:55.008: [!] error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher

I thought about upgrading the SSL engine, but thought I had read a post saying David didn't think it was wise to upgrade to the newest SSL for some reason. Which are the "two SSL files" you refer, the OpenSSL.exe and OpenSSL.cnf? I noticed their is a CFG file as well, I assume this is something not needed to be user-configured.

Thanks again!

Thanks for the feedback!&nbsp; I reached out to the issuing company, and they built me a .PEM with the private/public keys just as I'd done, but used a different keys (I think they re-issued my key).&nbsp; Using that, I started getting a different error:&nbsp; <div> </div><div>&nbsp;</div><div>08:33:55.008: [!] OpenSSL reported errors during handshake - error queue follows:</div><div>08:33:55.008: [!] -------------------------------------------------------------------------</div><div>08:33:55.008: [!] error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher</div><div>&nbsp;</div><div>I thought about upgrading the SSL engine, but thought I had read a post saying David didn't think it was wise to upgrade to the newest SSL for some reason.&nbsp; Which are the "two SSL files" you refer, the OpenSSL.exe and OpenSSL.cnf?&nbsp; I noticed their is a CFG file as well, I assume this is something not needed to be user-configured.&nbsp;</div><div>&nbsp;</div><div>Thanks again!&nbsp;</div>

cretson

posted Jan 12 '19 at 3:04 pm

Oh, should have mentioned I did restart Mercury, rebooted the computer too. I also removed the old key from Windows 10's key store (I had done this trying to get it to stop giving me warnings that I'm using a self-signed cert while connecting to the mail server from the mail server)

Oh, should have mentioned I did restart Mercury, rebooted the computer too.&nbsp; I also removed the old key from Windows 10's key store (I had done this trying to get it to stop giving me warnings that I'm using a self-signed cert while connecting to the mail server from the mail server)

cretson

posted Jan 14 '19 at 7:08 pm

OK, so still struggling. Tried installing Mercury 4.80 on a old Windows 7 machine, and the certificate generation works! I created a CSR using this copy, revoked my certificate, and requested a new one using the CSR. I compiled them into a single file (PRIVATE KEY and CERTIFICATE), as I gather you're supposed to do. Now I'm getting a new error, seems to make 2 session logs when I attempt to connect. Any hints?

12:59:56.261: --- 14 Jan 2019, 12:59:56.261 ---

12:59:56.261: Accepted connection from 'xxx.xxx.xxx.xxx', timeout 120 seconds.

12:59:56.266: Connection from xxx.xxx.xxx.xxx, Mon, 14 Jan 2019 12:59<cr><lf>

12:59:56.266: << * OK d IMAP4rev1 Mercury/32 v4.80.145 server ready.<cr><lf>

12:59:56.331: >> 1 CAPABILITY<cr><lf>

12:59:56.331: << * CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED X-MERCURY-1<cr><lf>

12:59:56.331: << 1 OK CAPABILITY complete.<cr><lf>

12:59:56.391: >> 2 STARTTLS<cr><lf>

12:59:56.391: << 2 OK Begin SSL/TLS negotiation now.<cr><lf>

-Then-

12:59:56.651: --- 14 Jan 2019, 12:59:56.651 ---

12:59:56.651: Accepted connection from 'xxx.xxx.xxx.xxx', timeout 120 seconds.

12:59:56.656: Connection from xxx.xxx.xxx.xxx, Mon, 14 Jan 2019 12:59<cr><lf>

12:59:56.656: << * OK d IMAP4rev1 Mercury/32 v4.80.145 server ready.<cr><lf>

12:59:56.661: >>

12:59:56.666: << * BAD Malformed command or oversize literal.<cr><lf>

12:59:56.666: >> ÀÀ

12:59:56.666: << * BAD Malformed command or oversize literal.<cr><lf>

12:59:56.666: >> retson.net

12:59:56.666: << * BAD Malformed command or oversize literal.<cr><lf>

12:59:56.726: 7: Socket read error 10054 (connection aborted by remote host)

12:59:56.731: --- Connection closed normally at 14 Jan 2019, 12:59:56.731. ---

12:59:56.731:

OK, so still struggling. Tried installing Mercury 4.80 on a old Windows 7 machine, and the certificate generation works!&nbsp; I created a CSR using this copy, revoked my certificate, and requested a new one using the CSR.&nbsp; I compiled them into a single file (PRIVATE KEY and CERTIFICATE), as I gather you're supposed to do.&nbsp; Now I'm getting a new error, seems to make 2 session logs when I attempt to connect.&nbsp; Any hints? <div><span style="font-size: 10pt;">&nbsp;</span></div><div>12:59:56.261: --- 14 Jan 2019, 12:59:56.261 ---</div><div>12:59:56.261: Accepted connection from 'xxx.xxx.xxx.xxx', timeout 120 seconds.</div><div>12:59:56.266: Connection from xxx.xxx.xxx.xxx, Mon, 14 Jan 2019 12:59&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.266: &lt;&lt; * OK d IMAP4rev1 Mercury/32 v4.80.145 server ready.&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.331: &gt;&gt; 1 CAPABILITY&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.331: &lt;&lt; * CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED X-MERCURY-1&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.331: &lt;&lt; 1 OK CAPABILITY complete.&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.391: &gt;&gt; 2 STARTTLS&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.391: &lt;&lt; 2 OK Begin SSL/TLS negotiation now.&lt;cr&gt;&lt;lf&gt;</div><div> </div><div>-Then-&nbsp;</div><div>&nbsp;</div><div>12:59:56.651: --- 14 Jan 2019, 12:59:56.651 ---</div><div>12:59:56.651: Accepted connection from 'xxx.xxx.xxx.xxx', timeout 120 seconds.</div><div>12:59:56.656: Connection from xxx.xxx.xxx.xxx, Mon, 14 Jan 2019 12:59&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.656: &lt;&lt; * OK d IMAP4rev1 Mercury/32 v4.80.145 server ready.&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.661: &gt;&gt; </div><div>12:59:56.666: &lt;&lt; * BAD Malformed command or oversize literal.&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.666: &gt;&gt; ÀÀ</div><div>12:59:56.666: &lt;&lt; * BAD Malformed command or oversize literal.&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.666: &gt;&gt; retson.net</div><div>12:59:56.666: &lt;&lt; * BAD Malformed command or oversize literal.&lt;cr&gt;&lt;lf&gt;</div><div>12:59:56.726: 7: Socket read error 10054 (connection aborted by remote host)</div><div>12:59:56.731: --- Connection closed normally at 14 Jan 2019, 12:59:56.731. ---</div><div>12:59:56.731:&nbsp;</div><div>&nbsp;</div>

cretson

posted Jan 16 '19 at 3:32 pm

Solved it!

For others' reference:

.PEM file should contain the entire trust chain. Like this:

-----PRIVATE KEY-----Private key data-----END PRIVATE KEY-----

-----CERTIFICATE-----Your certificate-----END CERTIFICATE-----

-----CERTIFICATE----- Trust chain certificate 1 -----END CERTIFICATE-----

-----CERTIFICATE----- Trust chain certificate 2-----END CERTIFICATE-----

<p>Solved it!&nbsp;</p><p>For others' reference:</p><p>.PEM file should contain the entire trust chain.&nbsp; Like this:</p><p> -----PRIVATE KEY-----<span style="font-size: 10pt;">Private key data</span><span style="font-size: 10pt;">-----END PRIVATE KEY-----</span></p><p>-----CERTIFICATE-----<span style="font-size: 10pt;">Your certificate</span><span style="font-size: 10pt;">-----END CERTIFICATE-----</span></p><p>-----CERTIFICATE-----<span style="font-size: 10pt;">&nbsp;Trust chain certificate 1&nbsp;</span><span style="font-size: 10pt;">-----END CERTIFICATE-----</span></p><p style="font-size: 13.3333px;">-----CERTIFICATE-----<span style="font-size: 13.3333px;">&nbsp;Trust chain certificate 2</span><span style="font-size: 13.3333px;">-----END CERTIFICATE-----</span></p>

jbanks

posted May 4 '19 at 10:20 pm

I have the exact same problem - did you ever find a fix?

Related Topics

Pending draft

Confirm move posts

Insufficient permissions

Select a different topic

Edit history