hMailServer 6.2.25: ACME issuance and renewal terminated the server process
-
ACME issuance and renewal ended the hMailServer process (#93). Anyone running automatic certificates on 6.2.24 lost the service on every issuance and every renewal.
Two calls in the ACME client handed the OpenSSL DLL a
FILE*opened by the server's own C runtime: the DANE TLSA line logged straight after issuance, and the re-read of the existing private key at the start of every renewal (the default,AcmeReuseKey). With noOPENSSL_Applinkexport in the executable, OpenSSL does not return an error. It writesOPENSSL_Uplink(...): no OPENSSL_Applinkto the Windows Application log under the source "OpenSSL" and callsTerminateProcess. The symptoms: an OpenSSL event whose message looks blank, a 7031 from the service control manager in the same second, no crash dump, and no "ACME (automatic)" certificate record. Both calls now go through OpenSSL's own file I/O, and the deployment runs before the TLSA line.If 6.2.24 issued you a certificate before it died, the files under
Data\ACMEare valid. 6.2.25 deploys them at its first ACME check after start-up and logs "issued but never deployed".What the upgrade involved
The schema moves from 6025 to 6030 in five steps, one way. DBUpdater runs them in order and resumes from a partial upgrade; there is no downgrade. The 6029 to 6030 step adds seventeen FOREIGN KEY constraints with ON DELETE CASCADE and removes the orphan rows they would refuse. On a large database it reads every child table once, so plan for it like an index build.
If you are on 6.2.21 or a 6.2.22/6.2.23 pre-release, read the 6.2.24 notes first. Everything there still applies.
Behaviour that changes without a switch
- The Apple
.mobileconfigprofile is served over HTTPS only. Plain HTTP gets a 301 to theWebServicesHttpsPortlistener, or a 403 when none is configured. A TLS-terminating proxy must sendX-Forwarded-Proto: https. - A Message-ID is added only to submissions (upstream #552). Relayed mail keeps its headers, so a filter counting on the header will now see messages without one.
- IMAP sequence numbers are stable within a session (upstream #602). Another session's expunge no longer renumbers a client's messages under it.
Also fixed: two restarts at once, one over COM and one from an ACME deployment or backup restore, rebuilt the same queues under each other and could end in an access violation. Restarts now run in sequence.
- The Apple
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login