On 02/09/2026 11:46 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
On Sep 1, 2026, at 23:40, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
On 01/09/2026 00:15 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
Hi!
You can't use STARTTLS on implicit TLS, because it already speaks TLS. It works if you drop the -starttls imap.
I just stumbled onto the problem. the config converter generated:
key_file = # hidden, use -P to show it
Replacing the key_file location solved the problem. I would recommend including a note at the end of the conversion indicating this issue as it is not very visible. I missed it many time going through the config file. Thanks,
-- Doug
This is because the input you gave it contained that same line. Doveconf -n outputs this without -P option.
Aki