On Sep 1, 2026, at 23:40, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
On 01/09/2026 00:15 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
Hi!
You can't use STARTTLS on implicit TLS, because it already speaks TLS. It works if you drop the -starttls imap.
mail# openssl s_client -connect 10.0.1.235:993 Connecting to 10.0.1.235 CONNECTED(00000003) 1010C6D407460000:error:0A000410:SSL routines:ssl3_read_bytes:ssl/tls alert handshake failure:/usr/src/crypto/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 40
no peer certificate available
No client certificate CA names sent Negotiated TLS1.3 group: <NULL>
SSL handshake has read 7 bytes and written 1524 bytes Verification: OK
New, (NONE), Cipher is (NONE) Protocol: TLSv1.3 This TLS version forbids renegotiation. Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok)
mail#
log shows:
Sep 2 00:13:32 test dovecot[85915]: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A0000C1:SSL routines::no shared cipher (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=10.0.1.230, lip=10.0.1.235, TLS handshaking: SSL_accept() failed: error:0A0000C1:SSL routines::no shared cipher, session=<MYHlxXpaM4AKAAHm>, port=993 Sep 2 00:13:32 test dovecot[85915]: auth: Debug: Read auth token secret from /var/run/home_mail//auth-token-secret.dat Sep 2 00:13:32 test dovecot[85915]: auth: Debug: passwd-file /usr/local/etc/dovecot/users:Read 5 users in 0 secs Sep 2 00:13:32 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [1]: Server accepted connection (fd=21) Sep 2 00:13:32 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [1]: auth client connected (pid=94429) Sep 2 00:13:32 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [1]: Disconnected: EOF (fd=21)