Problem with setup of 2.4
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
At this point is sits there accepting no input. The log shows:
Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: Server accepted connection (fd=21) Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: auth client connected (pid=86045)
There appears to be an SSL issue. The same certificates are used on both servers. Both servers are running FreeBSD 15.1. dovecot.conf is:
test# cat dovecot.conf
Conversion performed at 2026-08-23 05:06:46.587238
dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.0 auth_mechanisms = plain cram-md5 auth_verbose_passwords = no base_dir = /var/run/home_mail/ first_valid_gid = 0 imap_capability = SASL-IR LOGIN-REFERRALS ID ENABLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5 lda_mailbox_autocreate = yes login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} session=<%{session}> port=%{local_port} mail_driver = maildir mail_gid = 2222 mail_home = /var/mail/home_mail/%{user | username} mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from mail_log_prefix = %{protocol}(%{user})[%{remote_ip}]<%{session}>: mail_path = Maildir mail_temp_scan_interval = 0 mail_uid = 2222 postmaster_address = doug@sermon-archive.info protocols = imap syslog_facility = local1 verbose_proctitle = yes
namespace inbox { inbox = yes
mailbox Drafts { autoexpunge = 5 days special_use = \Drafts }
mailbox Junk { autoexpunge = 5 days special_use = \Junk }
mailbox Trash { autoexpunge = 50 days special_use = \Trash }
mailbox Sent { autoexpunge = 30 days special_use = \Sent }
mailbox "Sent Messages" { autoexpunge = 30 days special_use = \Sent } }
passdb passwd-file { auth_username_format = %{user | username} default_password_scheme = CRYPT driver = passwd-file passwd_file_path = /usr/local/etc/dovecot/users }
userdb static { driver = static
fields { allow_all_users = yes home = /var/mail/home_mail/%d/%n } }
service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } inet_listener imaps2 { port = 998 ssl = yes } }
service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } }
service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } }
ssl_server { cert_file = /www/certs/mail.pem dh_file = /usr/local/etc/dovecot/dh.pem key_file = # hidden, use -P to show it }
protocol lda { mail_plugins { sieve = yes } }
protocol imap { imap_metadata = yes
mail_plugins { mail_log = yes notify = yes } }
protocol pop3 { mail_plugins { mail_log = yes notify = yes } }
#sieve_script personal {
active_path = /var/mail/home_mail/%{user | username}/.dovecot.sieve
driver = file
path = /var/mail/home_mail/%{user | username}/sieve
#}
mail_attribute { dict file { path = %{home}/Maildir/dovecot-attributes } }
Warnings during conversion:
- <memory>:8: dropping removed setting 'auth_stats'
- <memory>:50: mail_plugins uses $SET:mail_plugins but adds nothing
- <memory>:180: no converter for 'plugin/@1/stats_refresh'
- <memory>:181: no converter for 'plugin/@1/stats_track_cmds'
- pruned default: inbox prefix = ''
log_debug = category=auth
-- Doug
On 01/09/2026 00:15 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
Hi!
You can't use STARTTLS on implicit TLS, because it already speaks TLS. It works if you drop the -starttls imap.
Aki
On Sep 1, 2026, at 23:40, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
On 01/09/2026 00:15 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
Hi!
You can't use STARTTLS on implicit TLS, because it already speaks TLS. It works if you drop the -starttls imap.
mail# openssl s_client -connect 10.0.1.235:993 Connecting to 10.0.1.235 CONNECTED(00000003) 1010C6D407460000:error:0A000410:SSL routines:ssl3_read_bytes:ssl/tls alert handshake failure:/usr/src/crypto/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 40
no peer certificate available
No client certificate CA names sent Negotiated TLS1.3 group: <NULL>
SSL handshake has read 7 bytes and written 1524 bytes Verification: OK
New, (NONE), Cipher is (NONE) Protocol: TLSv1.3 This TLS version forbids renegotiation. Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok)
mail#
log shows:
Sep 2 00:13:32 test dovecot[85915]: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A0000C1:SSL routines::no shared cipher (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=10.0.1.230, lip=10.0.1.235, TLS handshaking: SSL_accept() failed: error:0A0000C1:SSL routines::no shared cipher, session=<MYHlxXpaM4AKAAHm>, port=993 Sep 2 00:13:32 test dovecot[85915]: auth: Debug: Read auth token secret from /var/run/home_mail//auth-token-secret.dat Sep 2 00:13:32 test dovecot[85915]: auth: Debug: passwd-file /usr/local/etc/dovecot/users:Read 5 users in 0 secs Sep 2 00:13:32 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [1]: Server accepted connection (fd=21) Sep 2 00:13:32 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [1]: auth client connected (pid=94429) Sep 2 00:13:32 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [1]: Disconnected: EOF (fd=21)
On Sep 1, 2026, at 23:40, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
On 01/09/2026 00:15 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
Hi!
You can't use STARTTLS on implicit TLS, because it already speaks TLS. It works if you drop the -starttls imap.
I just stumbled onto the problem. the config converter generated:
key_file = # hidden, use -P to show it
Replacing the key_file location solved the problem. I would recommend including a note at the end of the conversion indicating this issue as it is not very visible. I missed it many time going through the config file. Thanks,
-- Doug
On 02/09/2026 11:46 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
On Sep 1, 2026, at 23:40, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
On 01/09/2026 00:15 EEST Doug Hardie via dovecot <dovecot@dovecot.org> wrote:
I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server:
master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more.
At that point I can login and view mail. However, if i use the same command on the test server:
master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003)
Hi!
You can't use STARTTLS on implicit TLS, because it already speaks TLS. It works if you drop the -starttls imap.
I just stumbled onto the problem. the config converter generated:
key_file = # hidden, use -P to show it
Replacing the key_file location solved the problem. I would recommend including a note at the end of the conversion indicating this issue as it is not very visible. I missed it many time going through the config file. Thanks,
-- Doug
This is because the input you gave it contained that same line. Doveconf -n outputs this without -P option.
Aki
participants (2)
-
Aki Tuomi
-
Doug Hardie