I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet
Connecting to 10.0.1.230
Can't use SSL_get_servername
depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2
verify return:1
depth=2 C=US, O=ISRG, CN=Root YE
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=YE2
verify return:1
depth=0 CN=mail.sermon-archive.info
verify return:1
. OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap
Connecting to 10.0.1.235
CONNECTED(00000003)
At this point is sits there accepting no input. The log shows:
Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: Server accepted connection (fd=21)
Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: auth client connected (pid=86045)
There appears to be an SSL issue. The same certificates are used on both servers. Both servers are running FreeBSD 15.1. dovecot.conf is:
test# cat dovecot.conf
# Conversion performed at 2026-08-23 05:06:46.587238
dovecot_config_version = 2.4.2
dovecot_storage_version = 2.4.0
auth_mechanisms = plain cram-md5
auth_verbose_passwords = no
base_dir = /var/run/home_mail/
first_valid_gid = 0
imap_capability = SASL-IR LOGIN-REFERRALS ID ENABLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5
lda_mailbox_autocreate = yes
login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} session=<%{session}> port=%{local_port}
mail_driver = maildir
mail_gid = 2222
mail_home = /var/mail/home_mail/%{user | username}
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
mail_log_fields = uid box msgid size from
mail_log_prefix = %{protocol}(%{user})[%{remote_ip}]<%{session}>:
mail_path = Maildir
mail_temp_scan_interval = 0
mail_uid = 2222
postmaster_address = doug(a)sermon-archive.info
protocols = imap
syslog_facility = local1
verbose_proctitle = yes
namespace inbox {
inbox = yes
mailbox Drafts {
autoexpunge = 5 days
special_use = \Drafts
}
mailbox Junk {
autoexpunge = 5 days
special_use = \Junk
}
mailbox Trash {
autoexpunge = 50 days
special_use = \Trash
}
mailbox Sent {
autoexpunge = 30 days
special_use = \Sent
}
mailbox "Sent Messages" {
autoexpunge = 30 days
special_use = \Sent
}
}
passdb passwd-file {
auth_username_format = %{user | username}
default_password_scheme = CRYPT
driver = passwd-file
passwd_file_path = /usr/local/etc/dovecot/users
}
userdb static {
driver = static
fields {
allow_all_users = yes
home = /var/mail/home_mail/%d/%n
}
}
service imap-login {
inet_listener imap {
port = 143
}
inet_listener imaps {
port = 993
ssl = yes
}
inet_listener imaps2 {
port = 998
ssl = yes
}
}
service auth {
unix_listener auth-userdb {
group = vmail
mode = 0666
user = vmail
}
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
}
service stats {
unix_listener stats-reader {
group = vmail
mode = 0660
user = vmail
}
unix_listener stats-writer {
group = vmail
mode = 0660
user = vmail
}
}
ssl_server {
cert_file = /www/certs/mail.pem
dh_file = /usr/local/etc/dovecot/dh.pem
key_file = # hidden, use -P to show it
}
protocol lda {
mail_plugins {
sieve = yes
}
}
protocol imap {
imap_metadata = yes
mail_plugins {
mail_log = yes
notify = yes
}
}
protocol pop3 {
mail_plugins {
mail_log = yes
notify = yes
}
}
#sieve_script personal {
# active_path = /var/mail/home_mail/%{user | username}/.dovecot.sieve
# driver = file
# path = /var/mail/home_mail/%{user | username}/sieve
#}
mail_attribute {
dict file {
path = %{home}/Maildir/dovecot-attributes
}
}
# Warnings during conversion:
# - <memory>:8: dropping removed setting 'auth_stats'
# - <memory>:50: mail_plugins uses $SET:mail_plugins but adds nothing
# - <memory>:180: no converter for 'plugin/@1/stats_refresh'
# - <memory>:181: no converter for 'plugin/@1/stats_track_cmds'
# - pruned default: inbox prefix = ''
log_debug = category=auth
-- Doug