[Dovecot] No CA names sent in TLS handshake
Hello,
I'm setting up Dovecot with client certificates and everything is working fine as long as the client only has one certificate in his store. If he has more than one, the wrong one might be sent to the server.
The root of the problem is that Dovecot does not send out a list of valid CA names in the TLS handshake.
If I connect using openssl s_client I get:
"No client certificate CA names sent"I am using Dovecot 1.0 RC15 from backports.org.
Is there a solution to this problem?
Regards, Johnny
On Tue, 2007-04-03 at 09:47 +0200, Johnny Chadda wrote:
Hello,
I'm setting up Dovecot with client certificates and everything is working fine as long as the client only has one certificate in his store. If he has more than one, the wrong one might be sent to the server.
The root of the problem is that Dovecot does not send out a list of valid CA names in the TLS handshake.
If I connect using openssl s_client I get:
"No client certificate CA names sent"
Well, I'm not that big of an OpenSSL guru, but googling shows that with other software it's often a certificate configuration problem.
Did you set ssl_ca_file and does the file contain a valid CA and CRL?
Timo Sirainen wrote:
Well, I'm not that big of an OpenSSL guru, but googling shows that with other software it's often a certificate configuration problem.
Did you set ssl_ca_file and does the file contain a valid CA and CRL?
Yes, the certificates are Ok. It works if I explicitly select which client certificate to send to the server from the mail client.
Normal users shouldn't have to do this though. It should be selected based on which accepted CA names the server sends. It works fine in Cyrus (which I will use if this does not work) and Postfix.
On Tue, 2007-04-03 at 11:50 +0200, Johnny Chadda wrote:
Timo Sirainen wrote:
Well, I'm not that big of an OpenSSL guru, but googling shows that with other software it's often a certificate configuration problem.
Did you set ssl_ca_file and does the file contain a valid CA and CRL?
Yes, the certificates are Ok. It works if I explicitly select which client certificate to send to the server from the mail client.
Normal users shouldn't have to do this though. It should be selected based on which accepted CA names the server sends. It works fine in Cyrus (which I will use if this does not work) and Postfix.
Does the attached patch fix it?
Timo Sirainen wrote:
On Tue, 2007-04-03 at 11:50 +0200, Johnny Chadda wrote:
Timo Sirainen wrote:
Well, I'm not that big of an OpenSSL guru, but googling shows that with other software it's often a certificate configuration problem.
Did you set ssl_ca_file and does the file contain a valid CA and CRL? Yes, the certificates are Ok. It works if I explicitly select which client certificate to send to the server from the mail client.
Normal users shouldn't have to do this though. It should be selected based on which accepted CA names the server sends. It works fine in Cyrus (which I will use if this does not work) and Postfix.
Does the attached patch fix it?
Indeed, it did! Thanks!
Hope to see this built-in in the next release. :)
participants (2)
-
Johnny Chadda
-
Timo Sirainen