为了查看邮件服务上的当前证书,需要在 Linux 中使用命令行进行查询:
IMAP - 查询证书
使用以下命令查询 IMAP 证书:
openssl s_client -showcerts -connect mail.synay.net:993 -servername mail.synay.net
其中 mail.synay.net 是邮件服务器的域名。此命令将返回如下内容:
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R11
verify return:1
depth=0 CN = synay.net
verify return:1
---
Certificate chain
0 s:CN = synay.net
i:C = US, O = Let's Encrypt, CN = R11
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Apr 8 07:57:57 2025 GMT; NotAfter: Jul 7 07:57:56 2025 GMT
-----BEGIN CERTIFICATE-----
MIIFIDCCBAigAwIBAgISBjIpZm7xKg/vcy8rxUa+cj9NMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTEwHhcNMjUwNDA4MDc1NzU3WhcNMjUwNzA3MDc1NzU2WjAUMRIwEAYDVQQD
EwlzeW5heS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1Y70V
xeJOpav/uJuevP/u9tlE8S03Ht7PuDfmTCql4GyTzpwOK2R8SLGlALFuDohAX+nW
xKLtN84uWqnyDGpsCsAzbos9jADmbro9J88nmXcSj2cH2vbEShrMPl2YcTrDsK/H
ewL8Z9bpjwHf/tR0ubGdDsqIfPCNE5p1gTmfN0QKKaSoI+1w7wMJeHvI865gNik6
Amy3nF4qhTXJdgXITTkZErd1bC433UFEheZaK1Uwv8CmIUMU0LOgcQTE4jhCAN8h
z/TCsqOJX8lU28tpxWfcDVYrEIS2062qpP474a//pbMJcn4kPVqkL+b4ZHRJNzBY
PrlKgJZpspIEff8ZAgMBAAGjggJLMIICRzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYE
FD1qp+LOPElq0b6lwi3skTKaia9QMB8GA1UdIwQYMBaAFMXPRqTq9MPAemyVxC2w
XpIvJuO5MFcGCCsGAQUFBwEBBEswSTAiBggrBgEFBQcwAYYWaHR0cDovL3IxMS5v
LmxlbmNyLm9yZzAjBggrBgEFBQcwAoYXaHR0cDovL3IxMS5pLmxlbmNyLm9yZy8w
IQYDVR0RBBowGIILKi5zeW5heS5uZXSCCXN5bmF5Lm5ldDATBgNVHSAEDDAKMAgG
BmeBDAECATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjExLmMubGVuY3Iub3Jn
Lzc4LmNybDCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AH1ZHhLheCp7HGFnfF79
+NCHXBSgTpWeuQMv2Q6MLnm4AAABlhSdfbUAAAQDAEcwRQIhAMAYci1qOpYgMKvg
QZxFuZ8MQY2KZoMhey+ip+Psgb/PAiA2r/Ko1+c5R2MxE8rBVmHkVh483h+5cFT3
zCLqXBZaJgB3AN3cyjSV1+EWBeeVMvrHn/g9HFDf2wA6FBJ2Ciysu8gqAAABlhSd
ff8AAAQDAEgwRgIhAIXX6rvIuiNY1hhyvFhmYOygIDS55GjJ+RRJ/nGu3+0hAiEA
gWE8/hzyaBbsKzevUUjRmTTGJEfWnSPXt1g+zjAmWxUwDQYJKoZIhvcNAQELBQAD
ggEBAHbpXL+FfISZ3o8atKYNU7g68fVVgssWBNSFADR99p3tU3omS86cYhAUr3gp
6djG/5YoNufFBx/lgWsxSrvfc+O/cMkipAeMAgLDxiAFBz9K7WPYyGmHMtRB5aVF
rF3cogZ4PWGuxxQzOoj3WwWPbXn+O3QgDoP4le49WfMpKZ1Ng0APKOV0CF30ySzK
9lO+T34A0Slcwqpjtb0SbHDBThCLO8lLYd4UZLoKfIozqX1Hx/rbaqn5PO24fzx8
/v013Lq2FWgLEdMheHpUuw73zMqE/hiJ3/oEorNo1lnB6QWzUqDvY/JQNf7zPeIV
MwMIdAmbMw0QSTkQ4DApYmFixBg=
-----END CERTIFICATE-----
完成后,将显示以下消息:
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready.
* BYE Disconnected for inactivity.
随后将显示其他中间证书链。为了获取所有域名和有效期的信息,可以将证书内容(包括 -----BEGIN CERTIFICATE----- 和 -----END CERTIFICATE----- 行)复制到记事本中,将文件扩展名从 .txt 更改为 .crt,或者使用 在线服务检查 CSR 请求或证书,将其粘贴到检查字段中。
如果您更新了邮件服务的证书,请不要忘记重启服务。从响应的最后几行可以看出,IMAP 使用 Dovecot 运行。
POP3 - 查询证书
使用以下命令查询 POP3 证书:
openssl s_client -showcerts -connect mail.synay.net:995 -servername mail.synay.net
服务器响应类似,示例中的 POP3 也使用 Dovecot 运行:
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R11
verify return:1
depth=0 CN = synay.net
verify return:1
---
Certificate chain
0 s:CN = synay.net
i:C = US, O = Let's Encrypt, CN = R11
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Apr 8 07:57:57 2025 GMT; NotAfter: Jul 7 07:57:56 2025 GMT
-----BEGIN CERTIFICATE-----
MIIFIDCCBAigAwIBAgISBjIpZm7xKg/vcy8rxUa+cj9NMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTEwHhcNMjUwNDA4MDc1NzU3WhcNMjUwNzA3MDc1NzU2WjAUMRIwEAYDVQQD
EwlzeW5heS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1Y70V
xeJOpav/uJuevP/u9tlE8S03Ht7PuDfmTCql4GyTzpwOK2R8SLGlALFuDohAX+nW
xKLtN84uWqnyDGpsCsAzbos9jADmbro9J88nmXcSj2cH2vbEShrMPl2YcTrDsK/H
ewL8Z9bpjwHf/tR0ubGdDsqIfPCNE5p1gTmfN0QKKaSoI+1w7wMJeHvI865gNik6
Amy3nF4qhTXJdgXITTkZErd1bC433UFEheZaK1Uwv8CmIUMU0LOgcQTE4jhCAN8h
z/TCsqOJX8lU28tpxWfcDVYrEIS2062qpP474a//pbMJcn4kPVqkL+b4ZHRJNzBY
PrlKgJZpspIEff8ZAgMBAAGjggJLMIICRzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYE
FD1qp+LOPElq0b6lwi3skTKaia9QMB8GA1UdIwQYMBaAFMXPRqTq9MPAemyVxC2w
XpIvJuO5MFcGCCsGAQUFBwEBBEswSTAiBggrBgEFBQcwAYYWaHR0cDovL3IxMS5v
LmxlbmNyLm9yZzAjBggrBgEFBQcwAoYXaHR0cDovL3IxMS5pLmxlbmNyLm9yZy8w
IQYDVR0RBBowGIILKi5zeW5heS5uZXSCCXN5bmF5Lm5ldDATBgNVHSAEDDAKMAgG
BmeBDAECATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjExLmMubGVuY3Iub3Jn
Lzc4LmNybDCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AH1ZHhLheCp7HGFnfF79
+NCHXBSgTpWeuQMv2Q6MLnm4AAABlhSdfbUAAAQDAEcwRQIhAMAYci1qOpYgMKvg
QZxFuZ8MQY2KZoMhey+ip+Psgb/PAiA2r/Ko1+c5R2MxE8rBVmHkVh483h+5cFT3
zCLqXBZaJgB3AN3cyjSV1+EWBeeVMvrHn/g9HFDf2wA6FBJ2Ciysu8gqAAABlhSd
ff8AAAQDAEgwRgIhAIXX6rvIuiNY1hhyvFhmYOygIDS55GjJ+RRJ/nGu3+0hAiEA
gWE8/hzyaBbsKzevUUjRmTTGJEfWnSPXt1g+zjAmWxUwDQYJKoZIhvcNAQELBQAD
ggEBAHbpXL+FfISZ3o8atKYNU7g68fVVgssWBNSFADR99p3tU3omS86cYhAUr3gp
6djG/5YoNufFBx/lgWsxSrvfc+O/cMkipAeMAgLDxiAFBz9K7WPYyGmHMtRB5aVF
rF3cogZ4PWGuxxQzOoj3WwWPbXn+O3QgDoP4le49WfMpKZ1Ng0APKOV0CF30ySzK
9lO+T34A0Slcwqpjtb0SbHDBThCLO8lLYd4UZLoKfIozqX1Hx/rbaqn5PO24fzx8
/v013Lq2FWgLEdMheHpUuw73zMqE/hiJ3/oEorNo1lnB6QWzUqDvY/JQNf7zPeIV
MwMIdAmbMw0QSTkQ4DApYmFixBg=
-----END CERTIFICATE-----
请求结束时将显示类似的成功执行消息:
read R BLOCK
+OK Dovecot ready. <254142.9ae9.683f08b3.59caa70dz5WbqgCQ7aLJKg==@hosting.synay.net>
SMTP - 查询证书
使用以下命令查询 SMTP 证书:
openssl s_client -showcerts -connect mail.synay.net:465 -servername mail.synay.net
响应如下:
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O thảo Let's Encrypt, CN = R11
verify return:1
depth=0 CN = synay.net
verify return:1
---
Certificate chain
0 s:CN = synay.net
i:C = US, O = Let's Encrypt, CN = R11
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Apr 8 07:57:57 2025 GMT; NotAfter: Jul 7 07:57:56 2025 GMT
-----BEGIN CERTIFICATE-----
MIIFIDCCBAigAwIBAgISBjIpZm7xKg/vcy8rxUa+cj9NMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTEwHhcNMjUwNDA4MDc1NzU3WhcNMjUwNzA3MDc1NzU2WjAUMRIwEAYDVQQD
EwlzeW5heS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1Y70V
xeJOpav/uJuevP/u9tlE8S03Ht7PuDfmTCql4GyTzpwOK2R8SLGlALFuDohAX+nW
xKLtN84uWqnyDGpsCsAzbos9jADmbro9J88nmXcSj2cH2vbEShrMPl2YcTrDsK/H
ewL8Z9bpjwHf/tR0ubGdDsqIfPCNE5p1gTmfN0QKKaSoI+1w7wMJeHvI865gNik6
Amy3nF4qhTXJdgXITTkZErd1bC433UFEheZaK1Uwv8CmIUMU0LOgcQTE4jhCAN8h
z/TCsqOJX8lU28tpxWfcDVYrEIS2062qpP474a//pbMJcn4kPVqkL+b4ZHRJNzBY
PrlKgJZpspIEff8ZAgMBAAGjggJLMIICRzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYE
FD1qp+LOPElq0b6lwi3skTKaia9QMB8GA1UdIwQYMBaAFMXPRqTq9MPAemyVxC2w
XpIvJuO5MFcGCCsGAQUFBwEBBEswSTAiBggrBgEFBQcwAYYWaHR0cDovL3IxMS5v
LmxlbmNyLm9yZzAjBggrBgEFBQcwAoYXaHR0cDovL3IxMS5pLmxlbmNyLm9yZy8w
IQYDVR0RBBowGIILKi5zeW5heS5uZXSCCXN5bmF5Lm5ldDATBgNVHSAEDDAKMAgG
BmeBDAECATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjExLmMubGVuY3Iub3Jn
Lzc4LmNybDCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AH1ZHhLheCp7HGFnfF79
+NCHXBSgTpWeuQMv2Q6MLnm4AAABlhSdfbUAAAQDAEcwRQIhAMAYci1qOpYgMKvg
QZxFuZ8MQY2KZoMhey+ip+Psgb/PAiA2r/Ko1+c5R2MxE8rBVmHkVh483h+5cFT3
zCLqXBZaJgB3AN3cyjSV1+EWBeeVMvrHn/g9HFDf2wA6FBJ2Ciysu8gqAAABlhSd
ff8AAAQDAEgwRgIhAIXX6rvIuiNY1hhyvFhmYOygIDS55GjJ+RRJ/nGu3+0hAiEA
gWE8/hzyaBbsKzevUUjRmTTGJEfWnSPXt1g+zjAmWxUwDQYJKoZIhvcNAQELBQAD
ggEBAHbpXL+FfISZ3o8atKYNU7g68fVVgssWBNSFADR99p3tU3omS86cYhAUr3gp
6djG/5YoNufFBx/lgWsxSrvfc+O/cMkipAeMAgLDxiAFBz9K7WPYyGmHMtRB5aVF
rF3cogZ4PWGuxxQzOoj3WwWPbXn+O3QgDoP4le49WfMpKZ1Ng0APKOV0CF30ySzK
9lO+T34A0Slcwqpjtb0SbHDBThCLO8lLYd4UZLoKfIozqX1Hx/rbaqn5PO24fzx8
/v013Lq2FWgLEdMheHpUuw73zMqE/hiJ3/oEorNo1lnB6QWzUqDvY/JQNf7zPeIV
MwMIdAmbMw0QSTkQ4DApYmFixBg=
-----END CERTIFICATE-----
随后是证书链,请求结束时显示成功执行的行:
read R BLOCK
220 mail.synay.net ESMTP Postfix (Debian/GNU)
从这些请求中可以查看和验证所有服务的证书,在本例中,邮件发送使用的是 Postfix。
这些命令在自行配置的邮件服务器证书过期时非常有用,通过此类请求,您可以准确知道警告与哪个服务相关。
No Comments Yet