On Tue, May 02, 2023 at 09:54:48AM -0400, Viktor Dukhovni via Postfix-users
wrote:
> What are some domains your server accepts mail for? Do you perhaps
> publish DANE TLSA records and have botched certificate rotation?
See if dropping the DST cross cert from your certificate chain will
help. That root CA has long ago expired.
Issuer: C=US, O=Let's Encrypt, CN=R3
Not Before: Apr 12 12:15:32 2023 GMT
Not After : Jul 11 12:15:31 2023 GMT
Subject: CN=mx1-edge.pgnetwork.net
Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C=US, O=Let's Encrypt, CN=R3
Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
Not Before: Jan 20 19:14:03 2021 GMT
Not After : Sep 30 18:14:03 2024 GMT
Subject: C=US, O=Internet Security Research Group, CN=ISRG Root X1
The "ISRG Root X1" CA no longer needs a cross cert.
--
Viktor.
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
