LMPT SSL

[Steffen Kaiser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 27 Jul 2015, Piotr Rotter wrote:

> I tryed to eneble TLS connection from postfix to dovecot lmtp. Unfortunely I 
> have problem with certificate, postfix shows,

post the output of doveconf -n

>
> 2015-07-27T12:51:15.025333+02:00 k30 postfix/lmtp[4572]: Untrusted TLS 
> connection established to 192.168.67.30[192.168.67.30]:24: TLSv1.2 with 
> cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
>
> I checked certs by openssl s_client:
> #openssl s_client -connect localhost:24 -showcerts -starttls smtp -CApath 
> /etc/ssl/certs/
>
> And I gets
>
> didn't found starttls in server response, try anyway...
> depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = 
> Domain Control Validated - RapidSSL(R), CN = mail.active24.pl
> verify error:num=20:unable to get local issuer certificate
> verify return:1
> depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = 
> Domain Control Validated - RapidSSL(R), CN = mail.active24.pl
> verify error:num=27:certificate not trusted
> verify return:1
> depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = 
> Domain Control Validated - RapidSSL(R), CN = mail.active24.pl
> verify error:num=21:unable to verify the first certificate
> verify return:1
>
> It look likes dovecot lmtp send 3 times the same certificate.
> I made the same test for imap in the same dovecot instance:
>
> #openssl s_client -connect localhost:143 -showcerts -starttls imap -CApath 
> /etc/ssl/certs/
> CONNECTED(00000003)
> depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
> verify return:1
> depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA - G3
> verify return:1
> depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = 
> Domain Control Validated - RapidSSL(R), CN = mail.active24.pl
> verify return:1
>
> For imap it looks ok. Why lmtp shows wrong certs list
>
> # dovecot --version
> 2.2.16
>
>

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEVAwUBVbYsIXz1H7kL/d9rAQIDbgf/UTzRhj6ZiiuknCHjmmFRwdbTk+qclXbo
vo2XtuH6V3WcuBoHwRedOiTuGH5g8WO2A+tl9wSSSvtw9TWurt2lLMfUsemWO4r4
zv7SwkTn2CVCIbZmC/3D1kqXHm08fuSo9Vn5/tgfgdOFwt5r4VfNkkp+zm72wFWT
o6uzL+EXSGEqnm/R1hFdC9cDZqKuzQ3MK+8qasoCPgMAr4svN0lwdi+yATaxzjgj
MviyKpdtQmA9gKRfLhptVcIP17rRNkoZKCS/Eboy6g/Rjf8c4C4Hn7lUbnx+kCVe
Xk4Z2cmlPhl17iyvzo8Tvyeuu/gxDEXfa/xgwRGhp0xx3c+WBOrJSg==
=a+SK
-----END PGP SIGNATURE-----