- dovecot - dovecot.org

[Dovecot] Sieve extprograms problem (broken pipe)
by Ron Guerin 23 Apr '14

23 Apr '14

I've been trying to pipe a message to an external script, and simplifying it as much as possible, I still get a broken pipe error. Can anyone point me in the right direction? X-Sieve: Pigeonhole Sieve 0.3.1 Using this script for debugging: -------------------------------- #!/bin/bash cat > /dev/null exit 0 server log contains: -------------------- Apr 21 19:45:18 generator dovecot: script: Error: write(response) failed: Broken pipe Apr 21 19:45:18 generator dovecot: lda(support(a)example.com): Error: sieve: execution of script /vmail/example.com/support//.dovecot. sieve failed, but implicit keep was successful (user logfile /vmail/example.com/support//.dovecot.sieve.log may reveal additional details) The logfile contains: --------------------- sieve: info: started log at Apr 21 20:13:50. error: msgid=<20140422001349.EA94C2A0CFD2(a)generator.vnetworx.net>: pipe action: failed to pipe message to program `sieve-pipe-supportticket': refer to server log for more information. [2014-04-21 20:13:50]. - Ron

2 1

[Dovecot] one way replication
by Pavel Stano 22 Apr '14

22 Apr '14

Hi, anyone using one way (or master/slave) replication instead of master/master ? There is no info in documentation but in sources (src/doveadm/dsync/doveadm-dsync.c) i found some flags which looks like for setting up master/slave switch (c) { case '1': ctx->oneway = TRUE; ctx->backup = TRUE; break; case 'R': ctx->reverse_backup = TRUE; break; So on master i add -1 : replication_dsync_parameters = -1 -d -n INBOX -l 30 -U and on slave -1 -R: replication_dsync_parameters = -1 -R -d -n INBOX -l 30 -U It looks it works, if i but question is if it is production ready. -- [ Ohodnotte kvalitu mailu: http://nicereply.com/websupport/Stano/ ] Pavel Stano | Troubleshooter http://WebSupport.sk *** BERTE A VYCHUTNAVAJTE ***

1 0

[Dovecot] dovecot-openssl.cnf - switch to 2048 bits?
by A M 22 Apr '14

22 Apr '14

Hello, Just had a query, from security point of view. Shouldn't dovecot-openssl.conf defaults now be 2048 bits? i.e. default_bits = 1024 I have read that 1024 bit certificates are now deprecated, since Dec 31, 2013. So may be we should have default as 2048 and can be changed manually if someone specifically wants 1024 or lower. Regards, A M

2 1

[Dovecot] "Reapplying" sieve rules
by Axel Luttgens 22 Apr '14

22 Apr '14

I did a mistake (shame on me). While migrating accounts on a new server, I didn't pay attention to a detail: sieve_max_actions, that I set to a low value for my testings, but then forgot to raise before the migration. As a result, several redirect-only accounts have now their inbox filled with messages that should have been redirected to "real people", then discarded. Would there be a nice way to "reapply" the sieve scripts, so that the messages of those mailboxes are redirected to their final recipients, the way they should have been upon arrival? Many thanks in advance, Axel

3 3

[Dovecot] FTS Lucene: Fatal: master: service(indexer-worker): child * killed with signal 6
by kfx 22 Apr '14

22 Apr '14

Hi List, Since we migrated from dovecot 1.2.4 to 2.2.12 with lucene as FTS engine, I have this in my error log: Apr 22 14:01:14 indexer-worker(username): Error: lucene index /var/vmail/username/lucene-indexes: IndexWriter() failed (#1): Lock obtain timed out Apr 22 14:01:14 indexer-worker: Error: indexer-worker [username(a)mydomain.com MailBox-1 - 20800/22707]: /home/anotherusername/newnew/clucene/src/core/CLucene/index/DocumentsWriter.cpp:210: std::string lucene::index::DocumentsWriter::closeDocStore(): Assertion `numDocsInStore*8 == directory->fileLength( (docStoreSegment + "." + IndexFileNames::FIELDS_INDEX_EXTENSION).c_str() )' failed. Apr 22 14:01:14 indexer: Error: Indexer worker disconnected, discarding 1 requests for username(a)mydomain.com Apr 22 14:01:14 indexer-worker(username(a)mydomain.com): Fatal: master: service(indexer-worker): child 31158 killed with signal 6 (core not dumped) Apr 22 14:01:16 imap(username): Error: indexer failed to index mailbox MailBox-2 Does that sound familiar to someone ? Thanks. # 2.2.12: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.11.2.el6.x86_64 x86_64 CentOS release 6.5 (Final) ext4 auth_cache_size = 10 M auth_debug = yes auth_master_user_separator = * auth_socket_path = /var/run/dovecot/auth-userdb auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@* auth_verbose = yes auth_verbose_passwords = sha1 base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-debug.log default_client_limit = 2128 default_process_limit = 512 default_vsz_limit = 2 G hostname = mydomain.com info_log_path = /var/log/dovecot.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * log_path = /var/log/dovecot-error.log login_greeting = Welcome login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_debug = yes mail_gid = vmail mail_location = maildir:/var/vmail/%Ln mail_plugins = fts fts_lucene quota stats mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = maildir:/var/vmail/%Ln mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = type = private } passdb { args = /usr/local/etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = lucene fts_autoindex = yes fts_autoindex_max_recent = 1000 fts_lucene = whitespace_chars=@ quota = maildir:User quota quota_rule = *:storage=20GB quota_rule2 = Trash:storage=+200M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = /var/sieve-scripts/%Ln.sieve sieve_dir = /var/vmail/%Ln/home/sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 30 secs stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } postmaster_address = postmaster(a)mydomain.com protocols = imap pop3 sieve sieve service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0777 user = vmail } } service decode2text { executable = script /usr/local/libexec/dovecot/decode2text.sh unix_listener decode2text { mode = 0666 } user = dovecot } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 5 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = nobody } service stats { fifo_listener stats-mail { mode = 0600 user = vmail } } ssl_cert = </etc/pki/tls/certs/mail.mydomain.com.pem ssl_key = </etc/pki/tls/private/mail.mydomain.com.key userdb { args = /usr/local/etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap override_fields = uid=vmail gid=vmail home=/var/vmail/%Ln/home } verbose_proctitle = yes protocol lda { mail_plugins = fts fts_lucene quota stats sieve virtual } protocol imap { mail_plugins = fts fts_lucene quota stats imap_quota virtual imap_stats }

1 0

[Dovecot] Trying to get DSpam+Dovecot working with Postfix and local/virtual domains
by Jeremy Doran 21 Apr '14

21 Apr '14

Hi, I'm hoping that someone might be able to help, as I've been going in circles with trying to get the right configuration done here. I'm also not sure whether this is more of a Dovecot or DSpam question, so I'm posting the same to both mailing lists. My goal is to have a mail setup that is as follows: [Incoming email] --> [Postfix] --> [Amavis] --> [DSpam] --> [Dovecot LDA] -+---(local domain)---> /var/mail/${user} | +---(virtual)---> /home/vmail/${domain}/${user}@{domain} As of right now, I have Postfix successfully feeding into Amavis, re-injecting into Postfix with a final delivery for the local domain via procmail, and final delivery for virtual domains via the virtual transport into maildir (but /home/vmail/${user}@${domain}) Virtual domains are being managed by PostfixAdmin. Dovecot is running as the IMAP server. Everything (Postfix, PostfixAdmin, Dovecot) is using a Postgres database as backend for the dynamic maps/authentication. The problem I've been stumbling over is trying to get DSpam to work nicely with both a local domain and virtual domains/mailboxes, and the same for Dovecot, as I would rather like to make use of the Sieve functionality going forward instead of Procmail. I did have DSpam working, but was unable to get the Dovecot antispam plugin working to re-train based on moving mails into/out of a defined 'SPAM' folder, due to permissions relating to how the antispam plugin was calling DSpam. I'm really not wanting to make the local domain into a virtual mailbox domain, because there are users on the system (for that local domain) that already use the password in /etc/passwd for accessing the server for other uses. While there are also people who do that who have virtual mailbox domains, it's a far lower number. Here's what I have so far. Postfix 2.11.0 main.cf (via 'postconf -nf'): alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, hash:/usr/local/mailman/data/aliases command_directory = /usr/local/sbin config_directory = /usr/local/etc/postfix content_filter = amavisfeed:[127.0.0.1]:10024 daemon_directory = /usr/local/libexec/postfix data_directory = /var/db/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 html_directory = /usr/local/share/doc/postfix inet_interfaces = all inet_protocols = ipv4 ipv6 local_recipient_maps = $transport_maps unix:passwd.byname $alias_maps mail_owner = postfix mailbox_command = /usr/local/bin/procmail -a "$EXTENSION" mailq_path = /usr/local/bin/mailq manpage_directory = /usr/local/man mydestination = $myhostname, localhost.$mydomain, $mydomain mydomain = critter.net myhostname = cornix.critter.net mynetworks = 127.0.0.0/8, 46.4.24.15/32, [::1]/128, [2a01:4f8:131:4263::]/64, 184.73.168.110/32, [2001:470:7:12ba::]/64 mynetworks_style = host myorigin = $mydomain newaliases_path = /usr/local/bin/newaliases queue_directory = /var/spool/postfix readme_directory = /usr/local/share/doc/postfix receive_override_options = no_address_mappings recipient_delimiter = - relay_domains = pgsql:$config_directory/Maps/pgsql_relay_domains_maps.cf sample_directory = /usr/local/etc/postfix sendmail_path = /usr/local/sbin/sendmail setgid_group = maildrop smtp_tls_CAfile = /etc/ssl/certs/Critter.Net_Certificate_Authority.pem smtp_tls_cert_file = /etc/ssl/certs/smtp.critter.net.pem smtp_tls_key_file = /etc/ssl/private/smtp.critter.net.pem smtp_tls_session_cache_database = /var/db/postfix/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP $mail_name smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_invalid_hostname, reject_rbl_client zen.spamhaus.org, check_policy_service inet:127.0.0.1:10023 smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_tls_CAfile = /etc/ssl/certs/Critter.Net_Certificate_Authority.pem smtpd_tls_ask_ccert = yes smtpd_tls_cert_file = /etc/ssl/certs/smtp.critter.net.pem smtpd_tls_key_file = /etc/ssl/private/smtp.critter.net.pem smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_session_cache_database = btree:/var/db/postfix/smtpd_scache smtpd_use_tls = yes soft_bounce = yes tls_random_source = dev:/dev/urandom transport_maps = pgsql:$config_directory/Maps/pgsql_transport_maps.cf unknown_local_recipient_reject_code = 450 virtual_alias_maps = pgsql:$config_directory/Maps/pgsql_virtual_alias_maps.cf virtual_gid_maps = static:400 virtual_mailbox_base = /home/vmail virtual_mailbox_domains = pgsql:$config_directory/Maps/pgsql_virtual_domain_maps.cf virtual_mailbox_limit = 51200000 virtual_mailbox_maps = pgsql:$config_directory/Maps/pgsql_virtual_mailbox_maps.cf virtual_minimum_uid = 400 virtual_transport = virtual virtual_uid_maps = static:400 master.cf (via 'postconf -Mf'): smtp inet n - n - - smtpd 24 inet n - n - - smtpd submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,permit_mynetworks,reject -o milter_macro_daemon_name=ORIGINATING smtps inet n - n - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,permit_mynetworks,reject -o milter_macro_daemon_name=ORIGINATING pickup unix n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - n 1000? 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - n - - smtp relay unix - - n - - smtp showq unix n - n - - showq error unix - - n - - error retry unix - - n - - error discard unix - - n - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil scache unix - - n - 1 scache amavisfeed unix - - - - 2 smtp -o syslog_name=postfix/amavisfeed -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes 127.0.0.1:10025 inet n - n - - smtpd -o syslog_name=postfix/amavis-reinject -o content_filter= -o smtpd_delay_reject=no -o smtpd_client_restrictions=permit_mynetworks,reject -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o smtpd_data_restrictions=reject_unauth_pipelining -o smtpd_end_of_data_restrictions= -o smtpd_restriction_classes= -o mynetworks=127.0.0.0/8,[::1]/128 -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o smtpd_client_connection_count_limit=0 -o smtpd_client_connection_rate_limit=0 -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters -o local_header_rewrite_clients= -o smtpd_milters= -o local_recipient_maps= -o relay_recipient_maps= dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop} Dovecot 2.2.10 config (via 'dovecot -n'): # 2.2.10: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE-p1 amd64 auth_debug = yes auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log first_valid_uid = 400 mail_location = mbox:~/Mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { driver = passwd } DSpam 3.9.0 dspam.conf: Home /var/db/dspam StorageDriver /usr/local/lib/dspam/libpgsql_drv.so TrustedDeliveryAgent "/usr/local/bin/procmail" UntrustedDeliveryAgent "/usr/bin/procmail -d %u" OnFail error Trust root Trust dspam Trust apache Trust mail Trust mailnull Trust smmsp Trust daemon TrainingMode teft TestConditionalTraining on Feature whitelist Algorithm graham burton Tokenizer chain PValue bcr WebStats on Preference "trainingMode=TEFT" # { TOE | TUM | TEFT | NOTRAIN } -> default:teft Preference "spamAction=quarantine" # { quarantine | tag | deliver } -> default:quarantine Preference "spamSubject=[SPAM]" # { string } -> default:[SPAM] Preference "statisticalSedation=5" # { 0 - 10 } -> default:0 Preference "enableBNR=on" # { on | off } -> default:off Preference "enableWhitelist=on" # { on | off } -> default:on Preference "signatureLocation=message" # { message | headers } -> default:message Preference "tagSpam=off" # { on | off } Preference "tagNonspam=off" # { on | off } Preference "showFactors=off" # { on | off } -> default:off Preference "optIn=off" # { on | off } Preference "optOut=off" # { on | off } Preference "whitelistThreshold=10" # { Integer } -> default:10 Preference "makeCorpus=off" # { on | off } -> default:off Preference "storeFragments=off" # { on | off } -> default:off Preference "localStore=" # { on | off } -> default:username Preference "processorBias=on" # { on | off } -> default:on Preference "fallbackDomain=off" # { on | off } -> default:off Preference "trainPristine=off" # { on | off } -> default:off Preference "optOutClamAV=off" # { on | off } -> default:off Preference "ignoreRBLLookups=off" # { on | off } -> default:off Preference "RBLInoculate=off" # { on | off } -> default:off AllowOverride enableBNR AllowOverride enableWhitelist AllowOverride fallbackDomain AllowOverride ignoreGroups AllowOverride ignoreRBLLookups AllowOverride localStore AllowOverride makeCorpus AllowOverride optIn AllowOverride optOut AllowOverride optOutClamAV AllowOverride processorBias AllowOverride RBLInoculate AllowOverride showFactors AllowOverride signatureLocation AllowOverride spamAction AllowOverride spamSubject AllowOverride statisticalSedation AllowOverride storeFragments AllowOverride tagNonspam AllowOverride tagSpam AllowOverride trainPristine AllowOverride trainingMode AllowOverride whitelistThreshold AllowOverride dailyQuarantineSummary MySQLUIDInSignature on PgSQLServer /tmp/ PgSQLUser dspam PgSQLPass xxxxxx PgSQLDb dspam HashRecMax 98317 HashAutoExtend on HashMaxExtents 0 HashExtentSize 49157 HashPctIncrease 10 HashMaxSeek 10 HashConnectionCache 10 Notifications off PurgeSignatures 14 # Stale signatures PurgeNeutral 90 # Tokens with neutralish probabilities PurgeUnused 90 # Unused tokens PurgeHapaxes 30 # Tokens with less than 5 hits (hapaxes) PurgeHits1S 15 # Tokens with only 1 spam hit PurgeHits1I 15 # Tokens with only 1 innocent hit LocalMX 127.0.0.1 SystemLog on UserLog on Opt out ParseToHeaders on ServerPID /var/run/dspam.pid ServerDomainSocketPath "/var/run/dspam.sock" ClientHost /var/run/dspam.sock ProcessorURLContext on ProcessorBias on StripRcptDomain off All of this is running on a FreeBSD 10-p1 server. I hope that someone has successfully implemented a similar setup to what I'm aiming for, and might be able to help. Thanks.

1 0

[Dovecot] Quick win... command to remove all attachments from an Inbox
by IT geek 31 19 Apr '14

19 Apr '14

Good evening all, Does anyone know of a doveadm command I can use to remove (delete) all attachments from an mdbox Inbox? I prefer to save my attachments and have a sleek Inbox... but sometimes I forget. A command I can feed into a cron job would be ideal. Many thanks, -Mark

3 4

[Dovecot] dkim test
by Benny Pedersen 19 Apr '14

19 Apr '14

just testing, if it tempfails on dovecot mail me private from the admins of dovecot maillist only

1 0

[Dovecot] Changing SSL certificates - switching from self-signed to RapidSSL
by Charles Marcus 19 Apr '14

19 Apr '14

Hi all, Ok, been wanting to do this for a while, and I after the Heartbleed fiasco, the boss finally agreed to let me buy some real certs... Until now, we've been using self-signed certs with the following dovecot config: ssl = required ssl_cert = </etc/ssl/ourCerts/imap.pem ssl_key = </etc/ssl/ourCerts/imap_key.pem Now, I've created new keys/certs and the CSR, got the new certs from RapidSSL (and also downloaded their Intermediate bundle), saved everything per their instructions, which say to reference them as follows: ssl = required ssl_cert_file = /etc/ssl/ourNewCerts/mail.ourdomain.com.crt ssl_key_file = /etc/ssl/ourNewCerts/mail.ourdomain.com.key ssl_ca_file = /etc/ssl/ourNewCerts/RapidSSL_Intermediate.crt But my current config doesn't have the _file for the variable names, and the wiki doesn't use them, so I'm planning on setting these to: ssl = required ssl_cert = /etc/ssl/ourNewCerts/mail.ourdomain.com.crt ssl_key = /etc/ssl/ourNewCerts/mail.ourdomain.com.key ssl_ca = /etc/ssl/ourNewCerts/RapidSSL_Intermediate.crt Anyone else ever used RapidSSL certs? Does this look correct? Thanks, Charles

6 20

Re: [Dovecot] Changing SSL certificates - switching from self-signed to RapidSSL
by Joseph Tam 19 Apr '14

19 Apr '14

Charles Marcus <CMarcus(a)Media-Brokers.com> wrote: > 2014-04-18T15:54:07-04:00 dinkumthinkum dovecot: imap-login: > Disconnected (no auth attempts in 0 secs): user=<>, TLS handshaking: > SSL_accept() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 > alert bad certificate: SSL alert number 42, rip=99.14.24.224, lport=143 > > Not a huge number, but enough to be concerning... > > Could this just be from cached junk from some clients, and they will > resolve themselves over time? Short answer: maybe. I got these errors when I switched from a self-signed to CA signed cert, and the client had an open mail session: Feb 22 02:10:32 imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=x.x.x.x, lip=y.y.y.y, TLS: SSL_read() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48, session=<w4Lm8vvypgCJUgmg> Not quite the same as your's, but if you call the client up and ask them to restart their mail client, I'm fairly confident these will go away, as for my user. You might get some weirdness if for some reason the client does not have the intermediate CAs cached. I ran into this problem with our certs -- some RH distributions did have the intermediate CA certs in its store. Joseph Tam <jtam.home(a)gmail.com>

2 1