On September 14, 2022 5:29:46 PM GMT+03:00, Tobias Wolter <towo@b1-systems.de> wrote:
Cheers,
Dovecot 2.3.4.1 (Debian stable) here, and the changelog does not offer any hope of salvation, so a bug report it is.
The LDAP connections for userdb/passdb do not support SNI via TLS.
Simple construct to reproduce this:
0.) Have a.pem with SAN
foo.example.com, b.pem withbar.example.com1.) Configure haproxy frontend withbind *:636 ssl crt /foo/a.pem ssl crt /foo/b.pem2.) Try to use ldaps://bar.example.com/ in passdb, receive "auth: Error: LDAP: Can't connect to server: ldaps://bar.example.com"Expectation, of course, would be for this to work; most libraries should support it, it's probably just a matter of convincing the appropriate binding.
Kind regards, -towo
Can you verify with
openssl s_client -connect bar.example.com:ldaps -servername bar.example.com
that correct cert is served?
Aki