Comodo certificate installed for the mail server. Mail client shows certificate expired

Symptoms

• Comodo/Sectigo certificate is installed for the mail service. Connections to the mail server with Webmail, PhpMailer or just with Mail Clients fails.

• Attempt to manually connect to SMTP port 465 with SSL shows “certificate expired” error and “AddTrust External” certificate:

  # openssl s_client -connect example.com:465
  depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
  verify error:num=10:certificate has expired
  notAfter=May 30 10:48:38 2020 GMT
  Verify return code: 10 (certificate has expired)

• Attempt to activate Comodo ModSecurity rules under Tools & Settings > Web Application Firewall (ModSecurity) shows an error:

  PLESK_ERROR: URLErrorWrapper: Error interacting with
  https://waf.comodo.com/doc/meta_comodo_apache.yaml: <urlopen error [SSL:
  CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)>
  Unable to download comodo_free rule set

Cause

TLS clients stopped working correctly when connecting to servers which use a certificate chained to the Sectigo root CN = AddTrust External CA Root on May 30, 2020. Here is Sectigo announce on that.

Resolution

To fix the issue explicitly disable the expired CA certificate.

CentOS:

Warning: There is no workaround for CentOS 6.

1. Login to the server with SSH.

2. Update ca-certificates package on the server:

   # yum update -y ca-certificates

Debian/Ubuntu:

1. Login to the server with SSH.

2. Execute the below command:

   # apt update && apt -y install ca-certificates