[Dovecot] SSL with startssl.com certificates

[Dan Langille]

On 2013-10-07 13:57, Bruno Tréguier wrote:
> Le 06/10/2013 à 22:42, Dan Langille a écrit :
> After a long delay, I'm ready to tackle this again.
> 
> [...]
> Testing via the command line gives:
> 
> $ openssl s_client -connect imaps.unixathome.org:993
> CONNECTED(00000003)
> depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate 
> Signing, CN = StartCom Certification Authority
> verify error:num=19:self signed certificate in certificate chain
> verify return:0
> 
> Ok, this is fine, and different from the result you were getting a few
> weeks ago. Your cert chain is ok, it seems. The "errornum=19:self 
> signed
> certificate in certificate chain" is a "normal" errot, due to the fact
> that you didn't tell openssl where to find a list of valid root certs.
> 
> 
> All looks good.
> 
> /var/log/maillog shows:
> 
> Oct  6 20:06:28 imaps dovecot: imap-login: Login: user=<dan>, 
> method=PLAIN, rip=98.111.147.220, lip=199.233.228.197, mpid=81052, TLS, 
> session=<fYUwEhjoVgBib5Pc>
> Oct  6 20:08:21 imaps dovecot: imap(dan): Disconnected: Logged out 
> in=26 out=691
> 
> 
> I have Thunderbird working just fine on my Macbook.
> 
> But my goal is mail.app on my iPhone and my Macbook.  When they try to 
> connect, the mail server logs are:
> 
> Oct  6 20:20:25 imaps dovecot: imap-login: Warning: SSL failed: 
> where=0x2002: SSLv3 read client certificate A [98.111.147.220]
> Oct  6 20:20:25 imaps dovecot: imap-login: Disconnected (no auth 
> attempts in 1 secs): user=<>, rip=98.111.147.220, lip=199.233.228.197, 
> TLS handshaking: Disconnected, session=<Ux8HRBjo7QBib5Pc>
> 
> Yet, the same iPhone and Macbook connect fine to a dovecot 1.2.17 
> installation.  That's my current IMAP server.  I'm moving to another 
> server and failing so far.
> 
> Suggestions to use another client app or platform will not be 
> entertained, because, clearly, this works with dovecot 1.
> 
> Well, sorry but no further suggestions as far as I'm concerned then,
> except that some people tend to think that mail.app is pretty crappy 
> and
> behaves quite strangely in certain situations...

I have given up. As much as I'd like to solve this problem, I must move 
on.  I will resort to self-signed certificates.[1]  I had hoped to 
resolve the issue so that others can use the solution.

My thanks to those that have offered suggestions and help.

[1] - FYI, I am the only user of this IMAP server.

-- 
Dan Langille - http://langille.org/