I’m running the latest version of Axigen, and use Let’s encrypt for TLS termination. This has worked without issue until a week or two ago. I started get “self signed” errors with both IMAP och SMTP connections. If I look in the folder on the server, the cert is updated and valid (witch is also confirmed in the WebAdmin).
The solution in another thread (couldn’t link to it) there was to add cert_auth.pem to CA file config for TLS settings. But I already have that one set. I tried renewing the certs just in case, and the logs seems ok.
2026-06-24 21:13:09 +0200 08 SRVLINWEB001 JOBLOG:70000002: LetsE: Certificate for DOMAIN is available at ``https://acme-v02.api.letsencrypt.org/acme/cert/05167e30fc990a10aa08e0295c0417cc99e9`` or /var/opt/axigen/letsencrypt/DOMAIN/cert.pem 2026-06-24 21:13:09 +0200 08 SRVLINWEB001 JOBLOG:70000002: LetsE: Intermediate certificate for /var/opt/axigen/letsencrypt/DOMAIN/cert.pem, downloaded from ``http://yr2.i.lencr.org/``, is available at /var/opt/axigen/letsencrypt/DOMAIN/cert_auth.pem
Both cert.pem and cert_auth.pem was updated (witch I could confirm on the file date stamp to).
Checking the cert chain with openssl gives me this:
It seems that this is related to the expiration of the Let’s encrypt DST Root CA X3 or something? Not sure where the issue resides though. I read something about ISRG_Root_X1/X2.crt, but those are present in my servers (Debian 13). Can’t really figure this out, and both the SMTP and IMAP if failing due to this.
Ok, it seems that the community forum isn’t any help here regarding getting support with errors in the application. I still can’t use Axigen to it’s full, sending mail fails.
Might be time to look for some other resource for mail server that works and where help is available. Most developers assist in application errors, thru github or other means of communication.
Could you share your current version? We have a fix for LE
AXI-7352: Fix Let’s Encrypt locally stored certificate chain (provided chain truncated)
that most probably is related to your report so if you are not already on 10.6.36 (btw, we have release this week 10.6.37) my suggestion is to update and try one more time.
I just updated to version 10.6.37 and tried it but still get cert error while trying to send mail on SMTP (and getting mail from IMAP). I also tried renewing the certs just in case, but to no avail.
Just tried another thing that actually fixed it, I revoked the entire certificate in whole and created a new one all together. That fixed it. It might been that the old cert was using old standard (had it for years), and it just renewed it with the same faulty root CA with DST Root CA X3.
10.6.37 does fix it, but upgrading alone will not fix a certificate issued prior to the fix AXI-7352.
The cause is Letsencrypt’s new generation Y hierarchy. Leaves are now issued by YR1/YR2 and those intermediates sit under ISRG Root YR from November 2025 that isn’t in the trust store yet.
The chain that needs to be served to clients is leaf → YR1 → Root YR (cross-signed by ISRG Root X1). Which is a total of 3 certificates.
Axigen prior to fix AXI-7352 serves 2 certificates. The acme client reads the AIA extension of the leaf, downloads the single certificate above it and stops there. This is clearly visible in the log above in @zynex’s report
Under the old hierarchy, a single hop was enough, as the leaf’s issuer was R10 or R11 whose issuer in turn is ISRG Root X1, which everything trusts. With the extra layer, it’s not enough anymore.
Under 10.6.37, it correctly writes the new cert_auth.pem with the full chain (I tested it twice, including with the file deleted prior to reissuing, so it was a genuine rewrite of the file and it did so correctly). But it doesn’t touch any cert_auth.pem file issued on a previous version of Axigen.
So anyone with this problem should reissue their existing certificate or patch the existing one by hand, which will fix it until next renewal when the updated 10.6.37 will write the cert_auth.pem correctly.