I've been running a Postfix/Dovecot mailserver for some time now (Ubuntu server 16.04), without any major issues. I also have a Let's Encrypt certificate issued to my hostname, which I setup in /etc/dovecot/conf.d/10-ssl.conf
. That was running fine but as you may know those are only valid for 90 days. I have certbot setup to renew these automatically, which is also working fine.
Suddenly, today, both my Thunderbird, a clients Thunderbird and his iPhone started to complain about invalid certificates. I checked the certificates through certbot certificates
to find out that the certificate I use was totally valid, not expired. Inspecting the certificate through Thunderbird told me the certificate had expired the day before, showing me a hash that did not match the current certificate.
So basically, it seems like Dovecot is issuing an expired certificate from some kind of 'cache'. Restarting dovecot just 'magically' fixed it but I'd like to understand what happened here since my DDG searches on certificate caches or alike in Dovecot didn't get me any results. Am I missing something obvious here? It seems like I've overlooked something obvious but can't figure out what.
EDIT This is basically answered here but since my certbot renews on a systemctl timer in stead of a cronjob I will try to provide the answer for that situation here for future reference and anyone in the same boat as I am.