Spark-Android-App: Certs Issues

omexlu

Hello,

The android app “Spark” is currently not sending out mails, and is grumbling about any expired certificates.

However, I have looked acme has kept all certificates up to date.

The problem is also only occurring since today.
Another app or even sogo or thunderbird work without problems.

Where can I look and what can this be due to?

Thanks in advance.

wasabi

Hi, is it possible that you use a reverse proxy?

BlaM

I have the same or at least a similar problem with my installation. I have several Spark clients that stopped working with the server recently and all I can see in the logs is a “certificateTrust” error

Spark:

ERROR Th:6164 [10-07 08:17:11.962] [RSMMailAccountSyncerErrorHandler] - #MAILSYNCER(1) Error: Error Domain=MailCoreErrorDomain Code=4 "(null)"
TRACE Th:6164 [10-07 08:17:11.962] [RSMAccountSyncerSimpleOperation<RSMMailAccountSyncer, InnerConfigureIdleOperation>] - operation was cancelled
WARN  Th:6164 [10-07 08:17:11.962] [CoreErrorNotificationObserver] - Received core error with code = 22 , domain = `RSMMessagesModelErrorDomain`, accountPk = 1
ERROR Th:6164 [10-07 08:17:11.963] [CoreErrorNotificationObserver] - certificateTrust error

Mailcow:

dovecot-mailcow_1    | Oct  7 09:32:22 7097ccce3257 dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.114.7.241, lip=172.28.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
dovecot-mailcow_1    | Oct  7 09:32:23 7097ccce3257 dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.114.7.241, lip=172.28.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
dovecot-mailcow_1    | Oct  7 09:32:24 7097ccce3257 dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.114.7.241, lip=172.28.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
dovecot-mailcow_1    | Oct  7 09:32:25 7097ccce3257 dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=46.114.7.241, lip=172.28.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
dovecot-mailcow_1    | Oct  7 09:32:25 7097ccce3257 dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.114.7.241, lip=172.28.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
dovecot-mailcow_1    | Oct  7 09:32:26 7097ccce3257 dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=46.114.7.241, lip=172.28.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

I only see the problem with Spark, so it is some compatibility issue with this combination of software.

I updated Spark
I updated Mailcow
I recently added a Reverse DNS Entry for the IPv6 address the server has (due to outgoing mails being blocked by GMail)
Forward DNS resolution is/was only set for IPv4 (I changed that a few minutes ago to try if that changes anything - I don’t expect it, though, because the clients are not connecting via IPv6)

wasabi

This could be related to Let´sencrypt´s recently expired (Sept.30th) root ca R3 cert?
Does Spark use a certificate cache or an own store?

BlaM

Uh, that sounds like a good hint. I have no clue how Spark works. From my point of view it’s "Select it from the App Store and press “Install” 😉" - and it’s closed source.

But Sept 30th sounds as if it could fit date-wise. I’ll get in touch with Spark support and hope they get this fixed, but is there anything that we can do server-wise (other than getting a paid certificate)?

wasabi

BlaM I’ll get in touch with Spark support and hope they get this fixed, but is there anything that we can do server-wise (other than getting a paid certificate)?

I´d say it depends….if you run a mailcow for your little family then you certainly can run with lets encrypt and switch (temporarily) to another mail client.
If you run mailcow for a company then maybe a paid certificate could be an option 😇

BlaM

Just a friends & family server - but even then a paid certificate is not out of reach anymore these days. Had good experience with ssl2buy, and they are cheap. But let’s wait and see how Spark handles the situation for a few days.