Fix the grommunio Let's Encrypt hook script

WalterH

The grommunio hook script for Let's Encrypt certificates contains an error: only the firsp part of the certificate chain is included in the grommunio certificate, and Android mobile devices do not consider such certificates to be trustworthy.
The faulty hook script looks like this:
cat /usr/share/grommunio-setup/grommunio-certbot-renew-hook

#!/bin/bash
# SPDX-License-Identifier: AGPL-3.0-or-later
# SPDX-FileCopyrightText: 2021 grommunio GmbH

openssl x509 -in "$RENEWED_LINEAGE/chain.pem" -out "$RENEWED_LINEAGE/chain-first.pem"
cat "$RENEWED_LINEAGE/cert.pem" "$RENEWED_LINEAGE/chain-first.pem" > "/etc/grommunio-common/ssl/server-bundle.pem"
cp "$RENEWED_LINEAGE/privkey.pem" "/etc/grommunio-common/ssl/server.key"
find /etc/grommunio-common/ssl/ -type f -exec chown -h gromox:gromox {} +
systemctl restart postfix gromox-http gromox-imap gromox-pop3 gromox-delivery-queue

These two lines are incorrect:
openssl x509 -in "$RENEWED_LINEAGE/chain.pem" -out "$RENEWED_LINEAGE/chain-first.pem"
cat "$RENEWED_LINEAGE/cert.pem" "$RENEWED_LINEAGE/chain-first.pem" > "/etc/grommunio-common/ssl/server-bundle.pem"

The first line only extracts one part of the chain, and the second line only copies this part of the chain in the grommunio certificate. Therefore, we need to remove the first line and replace the second line so that the fullchain.pem is copied into the certificate.

Test the certificate with the Qualys SSL Test. However, you can also use any other SSL test.
Note: You will see a "Not trusted" if only the first part of the certificate chain is includes in the grommunio certificate.

Read Part 2 to learn how to fix this error.

Thanks to @gbailey https://community.grommunio.com/d/2715-certbot-zertifikat-fur-smtpimappop3mapi-unvollstandig

WalterH

The easiest way to fix the hook script is to use these one-liners:

The repaired hook script will then look like this:

#!/bin/bash
# SPDX-License-Identifier: AGPL-3.0-or-later
# SPDX-FileCopyrightText: 2021 grommunio GmbH

#
cp "$RENEWED_LINEAGE/fullchain.pem" "/etc/grommunio-common/ssl/server-bundle.pem"
cp "$RENEWED_LINEAGE/privkey.pem" "/etc/grommunio-common/ssl/server.key"
find /etc/grommunio-common/ssl/ -type f -exec chown -h gromox:gromox {} +
systemctl restart postfix gromox-http gromox-imap gromox-pop3 gromox-delivery-queue

Note:

If an incomplete Let's Encrypt certificate has already been issued, you can manually repair it, but first you must repair the hook script.

Manualy repair the grommunio certificate:

Determine the name of your certificate. You can find this in /etc/letsencrypt/live/ using the command
ls -la /etc/letsencrypt/live/. You will see the certificate name there; in this example, it is mail.kunde.at. Replace mail.kunde.at with your certificate name.

# ls -la /etc/letsencrypt/live/
total 4
drwx------ 1 root root  72 Apr 27  2024 .
drwxr-xr-x 1 root root 324 Jun 19 14:29 ..
-rw-r--r-- 1 root root 740 Aug 24  2021 README
drwxr-xr-x 1 root root 124 Apr 20 00:05 mail.kunde.at

Manually copy the file fullchain.pem to server-bundle.pem, replacing mail.kunde.at with your certificate name:
cp "/etc/letsencrypt/live/**mail.kunde.at**/fullchain.pem" "/etc/grommunio-common/ssl/server-bundle.pem"
Restart the relevant services:
systemctl restart postfix gromox-http gromox-imap gromox-pop3 gromox-delivery-queue nginx
Remove the chain-first.pem file, it will never be used again:
rm -f "/etc/letsencrypt/live/**mail.kunde.at**/chain-first.pem"
Retest the certificate with the Qualys SSL Test.

The certificate should now be trusted.