Greetings all,

I have verified a bug that has long been attributed to lack of knowledge on the part of the user.

Dovecot rejects StartSSL client certificates due to reject StartSSL root CA when doing client verification even though the appropriately constructed ca-bundle.pem has been created and applied vi ssl_ca =

openssl verify -CAfile ca-bundle.pem -crl_check_all -policy_check -x509_strict -verbose client-cert.pem returns:

client-cert.pem: OK

However dovecot reports the following:

Oct 11 01:41:17 hostname dovecot: imap-login: Invalid certificate: unable to get local issuer certificate: /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority Oct 11 01:41:17 hostname dovecot: imap-login: Invalid certificate: certificate not trusted: /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority Oct 11 01:41:17 hostname dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority Oct 11 01:41:17 hostname dovecot: imap-login: Valid certificate: /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Client CA

Also reports the client certificate as valid.

The certificate bundle was created as follows:

openssl x509 -in sub.class1.client.pem -subject -issuer >ca-bundle.pem cat class1-client-crl.pem >>ca-bundle.pem openssl x509 -in startcom-root-ca.pem -subject -issuer >>ca-bundle.pem cat startcom-root-ca-crl.pem >>ca-bundle.pem

Furthermore exim, Thunderbird, and Firefox are all perfectly happy with the certificates (and exim has no problem verifying the client certificates).

Further, there are many more messages regarding issues with users of dovecot having issues with StartCom client certificates who have reported following all the steps than with Cyrus or Courier.

Oh, and client verification of server-side certificate works fine with server-side certificate bundle (cat server.pem startcom-intermediate.pem startcom-root-ca.pem >dovecot.pem)

Relevant dovecot -n included below:

auth_debug = yes auth_mechanisms = plain login digest-md5 cram-md5 otp auth_ssl_require_client_cert = yes auth_verbose = yes ssl = required ssl_ca =

OS is Debian Wheezy with latest updates and (just today in hopes it had been fixed, same error occurs with Wheezy's dovecot = 2.1.7) dovecot 2.2.9 from backports.

amd64 architecture.

Please CC me as I am not subscribed to the list.

Regards,

Daniel