Thanks for the suggestions guys. <div><br></div><div>I finally just turned off my re-write rule that was re-directing http to https and side-stepped the rt-mailgate ssl failure all together. Not ideal, but in practice very few of my users log into RT directly so it's a configuration I can live with short term while I figure out the real issue. </div>
<div><br></div><div>I've configured postfix to hand messages to the aliases for my queues directly to rt-mailgate. It is rt-mailgate that cannot verify the ssl certificate that my web server is presenting it. None of my web browsers have trouble with it, so it feels like an rt-mailgate configuration issue. I can repro the issue on the command line.... </div>
<div style="font-family:courier new,monospace"><br>
root@linux:~# /opt/rt4/bin/rt-mailgate --debug --queue 'general' --action correspond --url <a href="https://request.domain.com/" target="_blank">https://request.domain.com/</a> < ~/test.msg<br>
/opt/rt4/bin/rt-mailgate: temp file is '/tmp/XOCrOYAr8p/vkVDTmoszI'<br>
/opt/rt4/bin/rt-mailgate: connecting to <a href="https://request.domain.com//REST/1.0/NoAuth/mail-gateway" target="_blank">https://request.domain.com//REST/1.0/NoAuth/mail-gateway</a><br>
An Error Occurred<br>
=================<br>
<br>
500 Can't connect to<br>
<a href="http://request.domain.com:443/" target="_blank">request.domain.com:443</a> (certificate<br>
verify failed)<br>
<br>
/opt/rt4/bin/rt-mailgate: undefined server error</div><div><br></div><div>-Rob</div><div><br><br><div class="gmail_quote">On Mon, Jan 9, 2012 at 4:08 PM, Izz Abdullah <span dir="ltr"><<a href="mailto:Izz.Abdullah@hibbett.com" target="_blank">Izz.Abdullah@hibbett.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">And if that doesn't work, since I have a certificate with a domain name (although signed by our internal CA which all of our PCs trust), I had to put in below where Mauricio put in <a href="https://localhost" target="_blank">https://localhost</a>, I actually needed to use my dns name in which the certificate is assigned (e.g. <a href="https://MyRT" target="_blank">https://MyRT</a>)<br>
<br>
My $0.02 worth as well. :)<br>
<div><div><br>
-----Original Message-----<br>
From: <a href="mailto:rt-users-bounces@lists.bestpractical.com" target="_blank">rt-users-bounces@lists.bestpractical.com</a> [mailto:<a href="mailto:rt-users-bounces@lists.bestpractical.com" target="_blank">rt-users-bounces@lists.bestpractical.com</a>] On Behalf Of Mauricio Tavares<br>
Sent: Monday, January 09, 2012 4:02 PM<br>
To: <a href="mailto:rt-users@lists.bestpractical.com" target="_blank">rt-users@lists.bestpractical.com</a><br>
Subject: Re: [rt-users] rt-mailgate<br>
<br>
On Mon, Jan 9, 2012 at 1:34 PM, Robert Nesius <<a href="mailto:nesius@gmail.com" target="_blank">nesius@gmail.com</a>> wrote:<br>
> I made a recently change to how my apache2 server was configured to<br>
> redirect all requests through https. Now emails are not flowing<br>
> through to RT - I tracked the issue down to rt-mailgate complaining<br>
> about not being able to verify the certificate. I'm a little<br>
> perplexed on how to proceed or how to verify what certs/CAs<br>
> rt-mailgate is using, or if there is an issue with the Crypt::SSLeay module (which I had to force install due to a failing test).<br>
> I only have one openssl install on the system, and I thought<br>
> Crypt::SSLeay would reach through to those configs for things like CA certs, etc...<br>
><br>
> Perhaps an easy workaround, since the mail server and apache2 server<br>
> are on the same machine, would be to configure a "localhost:80"<br>
> virtual host within<br>
> apache2 and bypass SSL when accessing RT via that url.<br>
><br>
> Any helpful hints/suggestions would be greatly appreciated. I've<br>
> been google-ing away but haven't had any luck yet.<br>
><br>
AFAIK, rt-mailgate connects to RT using RT's web interface; it should use whatever cert you have defined in the virtual host entry for RT. Here is how my fetchmailrc calls rt-mailgate:<br>
<br>
mda "/usr/bin/perl /usr/bin/rt-mailgate --url <a href="https://localhost/rt" target="_blank">https://localhost/rt</a> \ --queue support --action correspond"<br>
<br>
> -Rob<br>
><br>
> --------<br>
> RT Training Sessions (<a href="http://bestpractical.com/services/training.html" target="_blank">http://bestpractical.com/services/training.html</a>)<br>
> * Boston - March 5 & 6, 2012<br>
--------<br>
RT Training Sessions (<a href="http://bestpractical.com/services/training.html" target="_blank">http://bestpractical.com/services/training.html</a>)<br>
* Boston March 5 & 6, 2012<br>
--------<br>
RT Training Sessions (<a href="http://bestpractical.com/services/training.html" target="_blank">http://bestpractical.com/services/training.html</a>)<br>
* Boston March 5 & 6, 2012<br>
</div></div></blockquote></div><br></div>