[Dovecot] Dovecot 2.0 config bug with SSL certificate per protocol?
Hi,
yesterday I upgraded Dovecot from 1.2 to 2.0.11. I'd seen that there was
a config file converter to make the upgrade smooth so was expecting it to
be pretty quick and easy. In the end I spent a long time trying to get it
working as it just wouldn't listen on the ssl ports, imaps and pop3s. I am
using per portocol SSL certificates, as I was in version 1.2. The part of
my config is as follows (as generated by doveconf):
protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_plugins = fts fts_squat ssl = yes ssl_cert = </usr/local/etc/ssl.crt/imap.crt ssl_key = </usr/local/etc/ssl.key/imap.key } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv ssl = yes ssl_cert = </usr/local/etc/ssl.crt/pop3.crt ssl_key = </usr/local/etc/ssl.key/pop3.key }
But when I started dovecot it was only listening on the non SSL ports for
IMAP and POP3. I went through many things, adding in a service imap-login
section with the SSL port set via inet_listener and spent ages googling
for how to get it to work. In the end it turns out it was that the global
ssl setting was set to "no", but I hadn't enabled this previously as this
requires that there are global SSL certificates, which I don't have; I
have specific certs for IMAP and for POP3. Also this isn't how dovecot 1.2
worked, there I specificed the protocols (pop3, pop3s, imap, imaps) and
specificed the protocol certs and it worked.
Anyway, I ended up just specifiing my pop3 certs as the global certs, this
is then redefined in the pop3 protcol section etc. The config seems to
work, but to me all this doesn't seem logical and doesn't work like in
dovecot 1.2.
Maybe this is something that can be cleaned up in the next version?
thanks Andy.
On Wed, 2011-04-06 at 11:18 +0200, Andy Smith wrote:
protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv ssl = yes ssl_cert = </usr/local/etc/ssl.crt/pop3.crt ssl_key = </usr/local/etc/ssl.key/pop3.key }
Anyway, I ended up just specifiing my pop3 certs as the global certs, this
is then redefined in the pop3 protcol section etc. The config seems to
work, but to me all this doesn't seem logical and doesn't work like in
dovecot 1.2.
It's too much trouble to make per-protocol ssl setting work, but it now logs a warning about it:
config: Warning: SSL is disabled because global ssl=no, ignoring ssl=yes for subsection
(naming the subsection would also be extra work..)
Quoting Timo Sirainen <tss@iki.fi>:
dovecot 1.2.
It's too much trouble to make per-protocol ssl setting work, but it now logs a warning about it:
config: Warning: SSL is disabled because global ssl=no, ignoring
ssl=yes for subsection(naming the subsection would also be extra work..)
So do the subsection certificates override the certificate set
globally? My config seems to work but could equally be the mail
clients not caring.
Is the error logged by the doveconf command? I didn't notice any
errors when actually starting the daemons. Also might be worth
pointing this out in the documentation, I think I probably missed it
in the errors from doveconf because there were so many!
thanks, Andy.
On Fri, 2011-04-08 at 16:38 +0100, a.smith@ukgrid.net wrote:
It's too much trouble to make per-protocol ssl setting work, but it now logs a warning about it:
config: Warning: SSL is disabled because global ssl=no, ignoring
ssl=yes for subsection(naming the subsection would also be extra work..)
So do the subsection certificates override the certificate set
globally? My config seems to work but could equally be the mail
clients not caring.
The cert overriding works. The global ssl=yes is just required so that Dovecot starts listening on the SSL ports (STARTTLS actually worked even without the global ssl=yes).
Is the error logged by the doveconf command? I didn't notice any
errors when actually starting the daemons. Also might be worth
pointing this out in the documentation, I think I probably missed it
in the errors from doveconf because there were so many!
I meant that I just today added the error message. Yes, it gets logged by doveconf command and also at each dovecot startup.
Quoting Timo Sirainen <tss@iki.fi>:
dovecot 1.2.
It's too much trouble to make per-protocol ssl setting work, but it now logs a warning about it:
config: Warning: SSL is disabled because global ssl=no, ignoring
ssl=yes for subsection(naming the subsection would also be extra work..)
Hi Timo,
So do the subsection certificates override the certificate set
globally? My config seems to work but could equally be the mail
clients not caring.
Is the error logged by the doveconf command? I didn't notice any
errors when actually starting the daemons. Also might be worth
pointing this out in the documentation, I think I probably missed it
in the errors from doveconf because there were so many!
thanks, Andy.
participants (3)
-
a.smith@ukgrid.net
-
Andy Smith
-
Timo Sirainen