- dovecot - dovecot.org

'duplicate listener' on port 465
by William David Edwards 17 Aug '25

17 Aug '25

Hi, When configuring SMTPS as described on https://doc.dovecot.org/main/core/config/submission.html#smtps, Dovecot says there is a 'duplicate listener'. MRE: ``` root@dovecot24-test:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-29-amd64 x86_64 Debian 12.11 # Hostname: dovecot24-test.cyberfusion.nl # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 dovecot_storage_version = 2.4.0 protocols = submission service submission-login { inet_listener submission_465 { port = 465 } } doveconf: Error: duplicate listener: 465:* doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: 465:* ``` Can anyone help me understand why this listener would be 'duplicate'? This setup worked on 2.3.21.1. Thanks! William David Edwards

2 1

github: minimal dovecot 2.4 setup for testing in docker
by Rory Campbell-Lange 15 Aug '25

15 Aug '25

Hi Everyone I've made a simple dovecot.conf and accompanying users.db file suitable for running in Docker. At the moment this simply shows how to force the default domain using the "auth_default_domain" setting. I'm hoping this will be a helpful jumping off point if you need to upgrade your Dovecot config ... and want to test outside of production. Instructions and the minimal conf and db file are here: https://github.com/rorycl/dovecot-config Feel free to improve the setup by submitting a PR. If you'd like to add some other scenarios please also submit PRs. My suggested arrangement for that is in a directory named by feature, with a README.md, minimal conf file, support files (only if necessary) and log.txt showing the expected output. Cheers Rory

1 0

function 'dovecot_lua_notify_event_message_new' in my lua script when I use push_notification_lua_driver
by 3825634＠qq.com 14 Aug '25

14 Aug '25

I need to push a message notification to external system when they receive new emails from their mailbox，so I used the push_notification_lua plugin. My dovecot configuration file is as follows： plugin {     ....     push_notification_driver = dlog     push_notification_driver2 = lua:file=/etc/dovecot/custom-lua/push-notification.lua     push_lua_url = http://localhost:10421/internal/dovecot/email-notification/receive } protocol lda {     mail_plugins = $mail_plugins sieve last_login push_notification mail_lua push_notification_lua     .... } ============= I print the 'event' param's value log in function 'dovecot_lua_notify_event_message_new' in my lua script: function dovecot_lua_notify_event_message_new(ctx, event)   dovecot.i_info("lua-push: event=" .. cjson.encode(event)) end However, when I send a mail with multiple recivers, the notification event info seems to work abnormally. Sender: wangzx(a)hxtmailtest.avicnet.cn Receivers: zhaoqb(a)hxtmailtest.avicnet.cn , wangzx7110(a)hxtmailtest.avicnet.cn I found the two event object's field 'to_address' and 'to_display_name' value are same in /var/log/dovecot/lda.log. Please help me confirm if this is a bug? The log in /var/log/dovecot/lda.log like bellow: 2025-08-06T09:38:11.383536+08:00 hxtmailtest-server dovecot: lda(wangzx7110(a)hxtmailtest.avicnet.cn)<548522><EkAeFgOykmiqXggAfhwsfQ>: lua-push: event={"snippet":"test!!","date":1754444290,"keywords":{},"to_display_name":"Zhaoqb","uid":19,"subject":"test","from_display_name":"","to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","tz":480,"mailbox":"INBOX","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","from":"wangzx(a)hxtmailtest.avicnet.cn","message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>","uid_validity":1752827738,"flags":{},"from_address":"wangzx(a)hxtmailtest.avicnet.cn","name":"MessageNew"} 2025-08-06T09:38:11.423272+08:00 hxtmailtest-server dovecot: lda(zhaoqb(a)hxtmailtest.avicnet.cn)<548524><znZfFwOykmisXggAfhwsfQ>: lua-push: event={"subject":"test","mailbox":"INBOX","flags":{},"snippet":"test!!","from":"wangzx(a)hxtmailtest.avicnet.cn","date":1754444290,"from_address":"wangzx(a)hxtmailtest.avicnet.cn","keywords":{},"uid_validity":1752634929,"to_display_name":"Zhaoqb","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","name":"MessageNew","from_display_name":"","tz":480,"to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","uid":39,"message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>"} Thanks! 3825634(a)qq.com 3825634(a)qq.com I need to push a message notification to external system when they receive new emails from their mailbox**so I used the push_notification_lua plugin. My dovecot configuration file is as follows** plugin { .... push_notification_driver = dlog push_notification_driver2 = lua:file=/etc/dovecot/custom-lua/push-notification.lua push_lua_url = http://localhost:10421/internal/dovecot/email-notification/receive } protocol lda { mail_plugins = $mail_plugins sieve last_login push_notification mail_lua push_notification_lua .... } ============= I print the 'event' param's value log in function 'dovecot_lua_notify_event_message_new' in my lua script: function dovecot_lua_notify_event_message_new(ctx, event) dovecot.i_info("lua-push: event=" .. cjson.encode(event)) end However, when I send a mail with multiple recivers, the notification event info seems to work abnormally. Sender: wangzx(a)hxtmailtest.avicnet.cn Receivers: zhaoqb(a)hxtmailtest.avicnet.cn , wangzx7110(a)hxtmailtest.avicnet.cn I found the two event object's field 'to_address' and 'to_display_name' value are same in /var/log/dovecot/lda.log. Please help me confirm if this is a bug? The log in /var/log/dovecot/lda.log like bellow: 2025-08-06T09:38:11.383536+08:00 hxtmailtest-server dovecot: lda(wangzx7110(a)hxtmailtest.avicnet.cn)<548522><EkAeFgOykmiqXggAfhwsfQ>: lua-push: event={"snippet":"test!!","date":1754444290,"keywords":{},"to_display_name":"Zhaoqb","uid":19,"subject":"test","from_display_name":"","to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","tz":480,"mailbox":"INBOX","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","from":"wangzx(a)hxtmailtest.avicnet.cn","message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>","uid_validity":1752827738,"flags":{},"from_address":"wangzx(a)hxtmailtest.avicnet.cn","name":"MessageNew"} 2025-08-06T09:38:11.423272+08:00 hxtmailtest-server dovecot: lda(zhaoqb(a)hxtmailtest.avicnet.cn)<548524><znZfFwOykmisXggAfhwsfQ>: lua-push: event={"subject":"test","mailbox":"INBOX","flags":{},"snippet":"test!!","from":"wangzx(a)hxtmailtest.avicnet.cn","date":1754444290,"from_address":"wangzx(a)hxtmailtest.avicnet.cn","keywords":{},"uid_validity":1752634929,"to_display_name":"Zhaoqb","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","name":"MessageNew","from_display_name":"","tz":480,"to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","uid":39,"message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>"} Thanks! [1][IMG] [2]3825634(a)qq.com 3825634(a)qq.com References Visible links 1. https://wx.mail.qq.com/home/index?t=readmail_businesscard_midpage&nocheck=t… 2. https://wx.mail.qq.com/home/index?t=readmail_businesscard_midpage&nocheck=t…

2 4

Re: Fw: upgrade mail paths (Debian 1:2.4.1)
by Rory Campbell-Lange 12 Aug '25

12 Aug '25

On 12/08/25, Andy Baugh (andy.baugh(a)webpros.com) wrote: > Colon separated vars need to be exploded into different params, sadly. This gets more complicated when dealing with things that are not mail opts. > > In your case you'll want to break down what used to be positional args thusly: > > mail_driver:mail_path:mail_inbox_path:mail_index_path > > Of course the "INBOX="/"INDEX=" part is assumed by the named param now, so can be left off the value. > > For example, with what used to be dsync or with quotas, things become rather painful to convert: ... Thank you very much for the confirmation, Andy. Exploding the configuration as you suggest works fine, although I had to quickly change my SQL table to suit. Fortunately I don't use quotas or dsync. I'm very grateful for your research into the configuration changes (which sound extensive) -- thanks again for sharing your insights. Let's hope the Debian stable upgrade doesn't cause too much pain. Best wishes, Rory

1 0

upgrade mail paths (Debian 1:2.4.1)
by rory＠campbell-lange.net 12 Aug '25

12 Aug '25

Dear Dovecot Users I guess there may be a storm of questions from users of Dovecot on Debian who are upgrading to the latest Debian stable, which uses Dovecot 1:2.4.1 [1] with the concomitant configuration changes. The issue I have encountered a problem translating my previous configuration for "mail_location" to "mail_path". The mail_location string returned from my database was mbox:/home/<user>/Mail/:INBOX=/var/mail/<user>:INDEX=/home/<domain>/Mailindexes/<user> Reading the mail location docs [2] I'm unclear if the colon separated configuration still works or if the configuration items should be separated into separate fields, presumably: mail_path mail_inbox_path mail_index_path Thanks for any insight. Regards, Rory [1] https://packages.debian.org/trixie/dovecot-core [2] https://doc.dovecot.org/main/core/config/mail_location.html

1 0

dovecot-sieve failed large mail
by Benoît PELISSIER 12 Aug '25

12 Aug '25

Hi, I noticed errors in the incoming emails with large attachments (>10MB). Its only with sieve filters enables. I use dovecot-lda and exim. Logs error : Error: program exec:/usr/sbin/sendmail (1295385): Execution timed out (> 30000 msecs) Error: program exec:/usr/sbin/sendmail (1295385): Failed to send SIGTERM signal to program Error: sieve: msgid=<**@**>: redirect action: failed to redirect message to <**@**>: Failed to execute sendmail (temporary failure) Error: sieve: Execution of script **/.dovecot.sieve was aborted due to temporary failure (user logfile **/.dovecot.sieve.log may reveal additional details) * i replaced private data by ** Regards, Benoît dovecot --version 2.3.13 (89f716dc2)

4 7

[Patch] Allow sieve redirects to specified domains only
by Kadlecsik József 10 Aug '25

10 Aug '25

Hello, The use case is simple: we have to forbid sieve redirects to outside, but should be able to redirect inside. The patch below adds a new sieve configuration option sieve_allowed_redirects to list the domains to which redirects are permitted and otherwise are not allowed. Please consider it. diff --git a/pigeonhole/doc/example-config/conf.d/90-sieve.conf b/pigeonhole/doc/example-config/conf.d/90-sieve.conf index 238bcf4..3b4ac65 100644 --- a/pigeonhole/doc/example-config/conf.d/90-sieve.conf +++ b/pigeonhole/doc/example-config/conf.d/90-sieve.conf @@ -126,6 +126,10 @@ plugin { # script execution. If set to 0, no redirect actions are allowed. #sieve_max_redirects = 4 + # The comma/space separated list of email domains where redirection is allowed. + # If the list is empty, there is no restriction. + sieve_allowed_redirects = + # The maximum number of personal Sieve scripts a single user can have. If set # to 0, no limit on the number of scripts is enforced. # (Currently only relevant for ManageSieve) diff --git a/pigeonhole/src/lib-sieve/cmd-redirect.c b/pigeonhole/src/lib-sieve/cmd-redirect.c index 6a3b0a4..17e9031 100644 --- a/pigeonhole/src/lib-sieve/cmd-redirect.c +++ b/pigeonhole/src/lib-sieve/cmd-redirect.c @@ -107,6 +107,24 @@ const struct sieve_action_def act_redirect = { .commit = act_redirect_commit, }; +static bool +cmd_redirect_allowed(struct sieve_instance *svinst, + const struct smtp_address *to_address) +{ + const char **domain; + bool result = TRUE; + + if (!svinst->allowed_redirects) + return TRUE; + for (domain = svinst->allowed_redirects; *domain != NULL; ++domain) { + if (strcasecmp(*domain, to_address->domain) == 0) { + return TRUE; + } + result = FALSE; + } + return result; +} + /* * Validation */ @@ -127,6 +145,12 @@ cmd_redirect_validate(struct sieve_validator *validator, if (!sieve_validator_argument_activate(validator, cmd, arg, FALSE)) return FALSE; + if (svinst->max_redirects == 0) { + sieve_command_validate_error(validator, cmd, + "local policy prohibits the use of a redirect action"); + return FALSE; + } + /* We can only assess the validity of the outgoing address when it is * a string literal. For runtime-generated strings this needs to be * done at runtime. @@ -148,14 +172,17 @@ cmd_redirect_validate(struct sieve_validator *validator, } } T_END; + if (!result && + !cmd_redirect_allowed(svinst, + sieve_address_parse_str(raw_address, &error))) { + sieve_command_validate_error(validator, cmd, + "local policy prohibits the use of a redirect action"); + return FALSE; + } + return result; } - if (svinst->max_redirects == 0) { - sieve_command_validate_error(validator, cmd, - "local policy prohibits the use of a redirect action"); - return FALSE; - } return TRUE; } @@ -238,6 +265,11 @@ cmd_redirect_operation_execute(const struct sieve_runtime_env *renv, "local policy prohibits the use of a redirect action"); return SIEVE_EXEC_FAILURE; } + if (!cmd_redirect_allowed(svinst, to_address)) { + sieve_runtime_error(renv, NULL, + "local policy prohibits the use of a redirect action"); + return SIEVE_EXEC_FAILURE; + } if (sieve_runtime_trace_active(renv, SIEVE_TRLVL_ACTIONS)) { sieve_runtime_trace(renv, 0, "redirect action"); diff --git a/pigeonhole/src/lib-sieve/sieve-common.h b/pigeonhole/src/lib-sieve/sieve-common.h index e79fb4d..d980c9d 100644 --- a/pigeonhole/src/lib-sieve/sieve-common.h +++ b/pigeonhole/src/lib-sieve/sieve-common.h @@ -209,6 +209,7 @@ struct sieve_instance { const struct smtp_address *user_email, *user_email_implicit; struct sieve_address_source redirect_from; unsigned int redirect_duplicate_period; + const char **allowed_redirects; }; /* diff --git a/pigeonhole/src/lib-sieve/sieve-settings.c b/pigeonhole/src/lib-sieve/sieve-settings.c index 47f70da..70addc7 100644 --- a/pigeonhole/src/lib-sieve/sieve-settings.c +++ b/pigeonhole/src/lib-sieve/sieve-settings.c @@ -267,4 +267,10 @@ void sieve_settings_load(struct sieve_instance *svinst) svinst->user_email = address; } } + svinst->allowed_redirects = NULL; + str_setting = sieve_setting_get(svinst, "sieve_allowed_redirects"); + if (str_setting != NULL && *str_setting != '\0') { + svinst->allowed_redirects = + (const char **)p_strsplit_spaces(svinst->pool, str_setting, ", "); + } } Best regards, Jozsef -- E-mail : kadlecsik.jozsef(a)wigner.hun-ren.hu PGP key: https://wigner.hu/~kadlec/pgp_public_key.txt Address: Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary

2 1

Empty "from:" on certain sieve rule
by Ciprian M. Vizitiu [FDT] 10 Aug '25

10 Aug '25

Hello everyone, Running a Dovecot 2.3.13 (Debian 11 native package) configured to deliver to Postfix lmtp and using dovecot-sieve. Setting-up a simple vacation responder works as expected but trying to catch a missing header e.g. if allof (not exists "X-GitLab-NotificationReason") { vacation :days 1 :addresses"SOME-NOTIFICATION(a)example.com" :subject "Message sent to an automated address " :from"some-sender(a)example.com" text: Hello, This is an automated reply to let you know thatSOME-NOTIFICATION(a)example.com is an automated address and is not read by a human operator. If you're trying to contact EXAMPLECOM please send your emails toexample(a)example.com . ; } ... will result in an empty "from:" field instead of the required "some-sender(a)example.com" e.g. Aug 06 09:41:45 email-001.example.com postfix/smtpd[1974551]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Aug 06 09:41:45 email-001.example.com dovecot[1174421]: lmtp(some-notification(a)email.example.com)<1974562><uTh/ITkHk2giIR4AdMz+wA>: sieve: msgid=<941c2ff0-56f1-493f-973e-871f446e060b(a)anotherexample.com>: vacation action: sent vacation response to <some.user(a)anotherexample.com> Aug 06 09:41:45 email-001.example.com postfix/pickup[1956559]: B7BF8207C9: uid=18018 from=<> Aug 06 09:41:45 email-001.example.com postfix/cleanup[1974554]: B7BF8207C9: message-id=<dovecot-sieve-1754466105-562992-0(a)email-001.example.com> Aug 06 09:41:45 email-001.example.com postfix/qmgr[1171599]: B7BF8207C9: from=<>, size=979, nrcpt=2 (queue active) Aug 06 09:41:45 email-001.example.com postfix/smtp[1974565]: B7BF8207C9: to=<some.user(a)anotherexample.com>, relay=smtpconnector.upper.relay[192.168.2.14]:25, delay=0.12, delays=0.06/0.01/0.03/0.02, dsn=5.7.1, status=bounced (host smtpconnector.upper.relay[192.168.2.14] said: 554 5.7.1 <>: Sender address rejected: Access denied (in reply to RCPT TO command)) I tried forcing sieve_user_email = some-sender(a)example.com ... but to no avail. I'm well aware that I could try and fix the problem at Postfix level but blindly catching ALL mails with an empty "from:" field feels bad: one miss-configured daemon and we spam everyone plus we already do some intricate rewriting. Any ideas? Hello everyone, Running a Dovecot 2.3.13 (Debian 11 native package) configured to deliver to Postfix lmtp and using dovecot-sieve. Setting-up a simple vacation responder works as expected but trying to catch a missing header e.g. if allof (not exists "X-GitLab-NotificationReason") { vacation :days 1 :addresses [1]"SOME-NOTIFICATION(a)example.com" :subject "Message sent to an automated address " :from [2]"some-sender(a)example.com" text: Hello, This is an automated reply to let you know that [3]SOME-NOTIFICATION(a)example.com is an automated address and is not read by a human operator. If you're trying to contact EXAMPLECOM please send your emails to [4]example(a)example.com . ; } ... will result in an empty "from:" field instead of the required [5]"some-sender(a)example.com" e.g. Aug 06 09:41:45 email-001.example.com postfix/smtpd[1974551]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Aug 06 09:41:45 email-001.example.com dovecot[1174421]: lmtp([6]some-notification(a)email.example.com)<1974562><uTh/ITkHk2giIR4AdMz+wA>: sieve: msgid=[7]<941c2ff0-56f1-493f-973e-871f446e060b(a)anotherexample.com>: vacation action: sent vacation response to [8]<some.user(a)anotherexample.com> Aug 06 09:41:45 email-001.example.com postfix/pickup[1956559]: B7BF8207C9: uid=18018 from=<> Aug 06 09:41:45 email-001.example.com postfix/cleanup[1974554]: B7BF8207C9: message-id=[9]<dovecot-sieve-1754466105-562992-0(a)email-001.example.com> Aug 06 09:41:45 email-001.example.com postfix/qmgr[1171599]: B7BF8207C9: from=<>, size=979, nrcpt=2 (queue active) Aug 06 09:41:45 email-001.example.com postfix/smtp[1974565]: B7BF8207C9: to=[10]<some.user(a)anotherexample.com>, relay=smtpconnector.upper.relay[192.168.2.14]:25, delay=0.12, delays=0.06/0.01/0.03/0.02, dsn=5.7.1, status=bounced (host smtpconnector.upper.relay[192.168.2.14] said: 554 5.7.1 <>: Sender address rejected: Access denied (in reply to RCPT TO command)) I tried forcing sieve_user_email = [11]some-sender(a)example.com ... but to no avail. I'm well aware that I could try and fix the problem at Postfix level but blindly catching ALL mails with an empty "from:" field feels bad: one miss-configured daemon and we spam everyone plus we already do some intricate rewriting. Any ideas? References Visible links 1. mailto:SOME-NOTIFICATION@example.com 2. mailto:some-sender@example.com 3. mailto:SOME-NOTIFICATION@example.com 4. mailto:example@example.com 5. mailto:some-sender@example.com 6. mailto:some-notification@email.example.com 7. mailto:941c2ff0-56f1-493f-973e-871f446e060b@anotherexample.com 8. mailto:some.user@anotherexample.com 9. mailto:dovecot-sieve-1754466105-562992-0@email-001.example.com 10. mailto:some.user@anotherexample.com 11. mailto:some-sender@example.com

2 1

Unable to specify home directory for mail_location
by jrmu＠ircnow.org 05 Aug '25

05 Aug '25

Greetings Dovecot team/users, I am trying to use Dovecot to serve Maildir files. The users' email is located in ~/Maildir (in each user's home directory). I tried specifying mail_location = maildir:~/Maildir but I get this error: Aug 4 00:06:34 ch dovecot: imap(username): Error: Relative home directory paths not supported: 0 Are relative home directory paths not supported? Here is the output of dovecot -n: # dovecot -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: OpenBSD 7.7 amd64 # Hostname: ch.ircnow.org auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = sha1 first_valid_uid = 1000 listen = 104.244.78.185, 2605:6400:c8b7::1 mail_debug = yes mail_location = maildir:~/Maildir mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=blf-crypt username_format=%u /etc/dovecot/passwd driver = passwd-file } ssl_cert = </etc/ssl/ch.ircnow.org.crt ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/passwd default_fields = quota_rule=*:storage=1G driver = passwd-file } verbose_ssl = yes 1375 bytes received in 0.00 seconds (5.18 MB/s) -- Aaron Lin jrmu(a)ircnow.org IRCNow (https://ircnow.org)

3 5

Dovecot fails to "initialize SSL server context"
by jaap＠jbril.net 04 Aug '25

04 Aug '25

I am configuring a new mailserver. Postfix works and is getting configured according to our wishes. Dovecot is more stubborn: for some reason I'm not able to understand, it refuses to "initialize SSL server context". complaining that "Can't load SSl Certificate". I believe I have configured the same certificate (and accompanying key) for imap-login that I use for https. But dovecot does not agree. I looked at error:14187180. All I found were errors on the configuration for the Certs cq Keys which I think I am avoiding . Two questions: Please correct me if I'm wrong. Can you clarify dovecot's error message? Jaap Server: * Rocky Linux 9.6 kernel 5.14.0-570.28.1 * Dovecot 2.3.21.1 * Openssl 3.2.2 * Certbot 3.1.0 Https is functioning as expected: ssl-config: * Include /etc/letsencrypt/options-ssl-apache.conf * SSLCertificateFile /etc/letsencrypt/live/radicale.camelopardus.nl/fullchain.pem * SSLCertificateKeyFile /etc/letsencrypt/live/radicale.camelopardus.nl/privkey.pem * ssl_cert = </etc/letsencrypt/live/iris.camelopardus.nl/fullchain.pem test from client: openssl s_client -connect radicale.camelopardus.nl:https reply: *CONNECTED(00000003)* *depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1* *verify return:1* *depth=1 C = US, O = Let’s Encrypt, CN = E6* *verify return:1* *depth=0 CN = radicale.camelopardus.nl* *verify return:1* Dovecot responds differently (for Thunderbird as well as) for openssl: conf.d/10-ssl.conf: * ssl_cert = </etc/letsencrypt/live/radicale.camelopardus.nl/fullchain.pem * ssl_key = </etc/letsencrypt/live/radicale.camelopardus.nl/privkey.pem test: openssl s_client -connect radicale.camelopardus.nl:imaps reply: CONNECTED(00000003) write:errno=104 no peer certificate available For both there is the same error in dovecot's log: imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): error:14187180: SSL routines:ssl_do_config:bad value: section=system_default, cmd=Groups, arg=X25519:secp256r1:X448:secp521r1:secp384r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192: user=<>, rip=2a10:3781:5ab:1:ff51:cbd1:4d54:fb7b, lip=2a10:3781:5ab:10::aaf,

4 4