How to install mail server?

[amadex13]

Port 25 is already used per default 1Panel installation. How to install Stalwart mail server to work properly?
I kill the process for port 25, but after server reboot Stalwart container is not working.

root@server:~# ss -tlnp | grep :25
LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=1831,fd=13))
LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=1831,fd=14))

[amadex13]

EDIT: Postfix was installed on server, either by 1Panel or per default OS image.

[wanghe-fit2cloud]

1Panel does not install Postfix by default, and it is not included in the App Store. Since the Stalwart container is failing to start, please check the container logs first to see the exact error message so we can identify the issue.

[amadex13]

1Panel does not install Postfix by default, and it is not included in the App Store. Since the Stalwart container is failing to start, please check the container logs first to see the exact error message so we can identify the issue.

I see, I've disabled postfix and installed Stalwart mail + Roundcube.

The problem is that my SSL for ports 993 and 465/587 are not working. It's a PositiveSSL that I use for the 1Panel too (and it works).

When I enter ports 993 and 587 on roundcube installation, I can't connect to mail via it.

[amadex13]

ad@Amars-MacBook-Air ~ % openssl s_client -showcerts -connect server.amadex.com:465 -servername server.amadex.com
Connecting to 213.246.45.181
CONNECTED(00000005)
depth=0 CN=server.amadex.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN=server.amadex.com
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN=server.amadex.com
verify return:1

Certificate chain
0 s:CN=server.amadex.com
i:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV R36
a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
v:NotBefore: Nov 29 00:00:00 2025 GMT; NotAfter: Nov 29 23:59:59 2026 GMT
-----BEGIN CERTIFICATE-----
MIIGfDCCBOSgAwIBAgIRAJyLOGceqz+/gvgTzqL2K9AwDQYJKoZIhvcNAQELBQAw
YDELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE
AxMuU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIENBIERWIFIz
NjAeFw0yNTExMjkwMDAwMDBaFw0yNjExMjkyMzU5NTlaMBwxGjAYBgNVBAMTEXNl
cnZlci5hbWFkZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
pwcg8GTXR/gVgIKT49PB/dVfL1pjBj7ACmEQAvPwk6BPQy3i68flQ9qVPu9s7REU
TveJM3ydEUmp7UbpNqk76uUi3UQdawP3eItgfaGkIY1IVZfPbDpH8j9TceMg9W6g
zDx0Q1+OEN+HGnE3Qzqckd1/JD546MwwGe2ZD9G4pDnguufzd2FpKCToGYQlHuad
P5rBrFfThpb6j7IEOzwaxg/gpGbQV0fC2JSTOYtPNX2NtUerzIfBqwmKu6GE6PdT
ivG8KkLAkAjmLMp6YfnRTZ2xMmf5dwFPdEhei6mqJx2YaV3DC2rmXm3Bm4m6FXpP
Pyv5I0JKkf8vLXhT/e12FwIDAQABo4IC8zCCAu8wHwYDVR0jBBgwFoAUaMASFhgO
r872h6YyV6NGUV3LBycwHQYDVR0OBBYEFFLgJcJNcytntW1kI0nDOjrCVdreMA4G
A1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMB
BggrBgEFBQcDAjBJBgNVHSAEQjBAMDQGCysGAQQBsjEBAgIHMCUwIwYIKwYBBQUH
AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECATCBhAYIKwYBBQUH
AQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3Rp
Z29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvbkNBRFZSMzYuY3J0MCMGCCsGAQUF
BzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAcBgNVHREEFTATghFzZXJ2ZXIu
YW1hZGV4LmNvbTCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFoAHYA1219ENGn9XfC
x+lf1wC/+YLJM1pl4dCzAXMXwMjFaXcAAAGazfaP8QAABAMARzBFAiEA4FeW0M/k
yX3EeIv71elG34TnSdnsngGm2eTnJT63DmoCIB+pDF1G9b7Gpr92orVLUo8nk9Sa
L3bBsxKvJboWHyOQAHYAr2eIO1ewTt2Pptl+9i6o64EKx3Fg8CReVdYML+eFhzoA
AAGazfaQxwAABAMARzBFAiAlGRQMwUiAdNwcTIkee3MuiaUXQV3kRZb0JAwfO4hE
hwIhAN25hcgCCsi/L4z83x9kF/Bo7D94O/m7CsRYpdtjYsohAHYArKswcGzr7IQx
9BPS9JFfER5CJEOx8qaMTzwrO6ceAsMAAAGazfaP8gAABAMARzBFAiEApFWP4Uhb
WSQxfTqqoyfYRi/oOD3KzWFdlwZRe8PDZSECIGlIroTXFq3GjA6YLWkAfrz+9Cg8
sOzBlEePn9J/MZu/MA0GCSqGSIb3DQEBCwUAA4IBgQA345bnu3eGCpWwzWN86Gch
V7tUGyMN5HffcNoVA7rbLdCRGI0V0er3L6uE/T9O7XnhWBAmcac7ZbywOjM9N08q
chItt3oswnW6mmMyBqaXOmcXnb2o1CFkeW/iPZMqPAB+oJa5ytaC7EcaoFhzW9fD
Rb54WpL+DAHqdAQ4rguz2lpaRU4q6lKikSa48ubV9p/Ww9J8WXWE5wdHHaki+L7i
QgpLq1jxw3T3U/TsiDZFdODL+3SIJLwlgXmyE4xdM9f0WYWS/FLbq+TDf9hS0Qfz
8njp5Ah8kGxnWqhkIVx784ybt+7+MWpeLcL/HlZt+SjjoM4LW2YiT0m0QXzI3XbS
zylBodn2foR2OzFbpVj1Hcgm7Vbb9p6g4Mqa5EPQJfmO6ar0g4BJxIFGgAQc7Zpc
qG4oEYap00nc0ZBxP0KSIXt45eS/VoB+dSvA5jt4QHjDq5ikhv3RPubTFiZflzEn
upTSrIYeMzZaxoEt7Euk/gzhC7mD8+J7DHUpVEAgv18=
-----END CERTIFICATE-----

Server certificate
subject=CN=server.amadex.com
issuer=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV R36

No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: rsa_pss_rsae_sha512
Peer Temp Key: X25519, 253 bits

SSL handshake has read 2158 bytes and written 1628 bytes
Verification error: unable to verify the first certificate

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)

---

Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: FC10D31841C46BA30C946FD95476C3EEC55E9327CAB2A4F9FC12C5622EC9A83C
Session-ID-ctx:
Resumption PSK: 9F56C9AC530DF37A593503497FDCFC6D810F402C534D7BE8AE4762979EC30D88F3D0742F9A4A8C2EBC6DBC4D524F0BFC
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 86400 (seconds)
TLS session ticket:
0000 - 30 0e 97 cc 77 a5 3c 6a-f3 80 f4 40 42 4b ca 92 0...w.<j...@bk..
0010 - cd 35 13 4d 7a f7 83 e7-50 0b c9 ee 18 cf 4b 33 .5.Mz...P.....K3

Start Time: 1764418187
Timeout   : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0

---

read R BLOCK

Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: BE519E13C3BE7A8B57B487C630FF604341DD17F2F34ABFC39361D78CD008D3A1
Session-ID-ctx:
Resumption PSK: 3836E591D3EBCC5491D04B9686E039D93B0DEEAD99C393A673B8D448A54D7B0ECC323AE48AF127D05C03C42F49485D04
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 86400 (seconds)
TLS session ticket:
0000 - fe de 39 90 4e 04 64 ec-1e f5 d1 49 83 4b 90 f2 ..9.N.d....I.K..
0010 - 7c f9 a1 e9 cc 30 a1 3c-1d 0a dd ad de 7c 74 3a |....0.<.....|t:

Start Time: 1764418187
Timeout   : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0

---

read R BLOCK
220 server.amadex.com Stalwart ESMTP at your service
^C
ad@Amars-MacBook-Air ~ % openssl s_client -showcerts -connect server.amadex.com:587 -servername server.amadex.com
Connecting to 213.246.45.181
CONNECTED(00000005)
8060D9ED01000000:error:0A00010B:SSL routines:tls_validate_record_header:wrong version number:ssl/record/methods/tlsany_meth.c:85:

no peer certificate available

No client certificate CA names sent
Negotiated TLS1.3 group:

SSL handshake has read 5 bytes and written 1548 bytes
Verification: OK

New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

8060D9ED01000000:error:0A000197:SSL routines:SSL_shutdown:shutdown while in init:ssl/ssl_lib.c:2834: