[Dovecot] kmail + IMAPS

[Benjamin R. Haskell]

On Sun, 23 Sep 2007, Timothy Murphy wrote:

> (1) I suspect the problem lies with authentication.
> But how can I test this?

>From past experience (but also came up as #1 when googling "testing 
IMAPS" w/o quotes) you should use:

openssl s_client -connect servername:993

If your dovecot does TLS negotiation [not sure if it's the default], you 
may also want to use/try:

openssl s_client -starttls imap -connect servername:143
(Caveat: -starttls only supported "smtp" and "pop3" on my system 
[OpenSSL 0.9.8d on Gentoo]. Don't know what the defaults are.)

993/143 can be replaced by imaps/imaps or whatever your ports are.

openssl s_client is a generally-useful tool for SSL/TLS testing 
(SMTPS/HTTPS/IMAPS/etc.).


> (2) [ skipping kmail question ]
>
> (3) I guess I don't understand exactly how TLS authentication works.
> Does installing openssl set up the correct certificates
> on server and client?

I had a really hard time with this myself, and I felt like I knew what I 
was doing. There are HOWTO's to setup the server-side self-signed 
certificates, but for the client-side setup, I went through much of:

Pine+OpenSSL HOWTO - http://www.madboa.com/geek/pine-ssl/

Some(/many?) of the sections are specific to Pine, the email client. But, 
any of the sections with openssl commands are generally useful (and, I 
think, well-explained).


> Is there any documentation on this?

For the server-side:
http://wiki.dovecot.org/SSL
http://wiki.dovecot.org/SSL/CertificateCreation
http://wiki.dovecot.org/SSL/DovecotConfiguration

The Apache SSL/TLS documentation linked-to from that page [/SSL] looks 
good:
http://httpd.apache.org/docs/2.2/ssl/ssl_intro.html


Best,
Ben