Can't figure out why managesieve (pigeonhole) can't connect

[Christian Mack]

Hello

This test only states, that you can connect to IMAP Port 143 with 
STARTTLS and use your certificate there.
It does not show, if your managesieve Port 4190 uses that certificate too.
Managesieve does not use STARTTLS, and has its own configurations.

I suspect, that in your certificate you do not have the private IP as 
alternate name included, as you try to reach 10.0.0.91:4190, not 
mydomain.com:4190.


Kind regards,
Christian Mack

Am 14.12.22 um 21:48 schrieb colin at colinlikesfood.com:
> 
> 
> Thank you for this.  I am not using self-signed, I am using letsencrypt 
> as a CA, the certs are installed where certbot put them.
> 
> I tried the example from https://wiki2.dovecot.org/TestInstallation, 
> using openssl s_client, and I achieved the following (lots of data 
> replaced with "...")
> 
> I have not changed anything else since your last reply, I am honestly 
> not sure what rc config has to do with certs (google has not given me a 
> result that seems to apply).  Does the below help confirm my certs are 
> properly installed and that i can connect to dovecot over tls and pass 
> my credentials?
> 
> -----
> 
> root at mc:~ # openssl s_client -connect mydomain.com:143 -starttls imap
> CONNECTED(00000004)
> depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
> verify return:1
> depth=1 C = US, O = Let's Encrypt, CN = R3
> verify return:1
> depth=0 CN = mydomain.com
> verify return:1
> ---
> Certificate chain
>   ...
> ---
> Server certificate
> -----BEGIN CERTIFICATE-----
> ..
> -----END CERTIFICATE-----
> ..
> ---
> No client certificate CA names sent
> Peer signing digest: SHA256
> Peer signature type: RSA-PSS
> Server Temp Key: X25519, 253 bits
> ---
> SSL handshake has read 4922 bytes and written 426 bytes
> Verification: OK
> ---
> ..
> ..
> ..
> ---
> read R BLOCK
> a login me at mydomain.com MyPass
> * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT 
> SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT 
> MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS 
> LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES 
> WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY 
> PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE
> a OK Logged in
> a OK Logged in
> b select inbox
> * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
> * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] 
> Flags permitted.
> * 35 EXISTS
> * 0 RECENT
> * OK [UNSEEN 18] First unseen.
> * OK [UIDVALIDITY 1669149589] UIDs valid
> * OK [UIDNEXT 255] Predicted next UID
> * OK [HIGHESTMODSEQ 615] Highest
> b OK [READ-WRITE] Select completed (0.001 + 0.000 secs).
> c list "" *
> * LIST (\HasNoChildren \Marked \Trash) "/" Trash
> * LIST (\HasNoChildren \UnMarked \Junk) "/" Junk
> * LIST (\HasNoChildren \Marked \Sent) "/" Sent
> * LIST (\HasNoChildren \Drafts) "/" Drafts
> * LIST (\HasNoChildren \UnMarked) "/" INBOX/email-reports
> * LIST (\HasNoChildren \UnMarked) "/" INBOX/NAS-Alerts
> * LIST (\HasChildren) "/" INBOX
> c OK List completed (0.001 + 0.000 secs).
> 
> On 2022-11-23 14:49, PGNet Dev wrote:
> 
>>> i don't understand why it can't connect, this seems to work fine:
>>
>> fine ?
>>
>> you're manually overriding at least one problem with your certs/config
>>
>>> ...
>>> - Status: The certificate is NOT trusted. The name in the certificate 
>>> does not match the expected.
>>> *** PKI verification of server certificate failed...
>>> Host 10.0.0.91 (sieve) has never been contacted before.
>>> Its certificate is valid for 10.0.0.91.
>>> Are you sure you want to trust it? (y/N): y
>>> ...
>>
>> it appears that you're using a self-signed cert?  are your trusted 
>> certs defined and correctly chained?  if not explicitly defined, did 
>> you correctly add you certs to system ssl dirs, and ensure hashes are 
>> correct?
>>
>> demonstrate first that you can connect to dovecot over tls with a cmd 
>> line client, without ignoring or overriding your cert problems
>>
>> including any client/server cert verification requirements you've 
>> turned on in dovecot config
>>
>> once you've passed the correct certs, then demonstrate that you can 
>> authenticate in the same session with any password/credentials you've set
>>
>> once that all works, make sure you've got those certs correctly set up 
>> in your rc config
> 
> 

-- 
Christian Mack
Universität Konstanz
Kommunikations-, Informations-, Medienzentrum (KIM)
Abteilung IT-Dienste Forschung, Lehre, Infrastruktur
78457 Konstanz
+49 7531 88-4416

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6007 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://dovecot.org/pipermail/dovecot/attachments/20221215/a625b6f1/attachment-0001.bin>