<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div>You are supposed to put the intermediates into the cert file after the cert in order from cert to root. ssl_ca is not used for this.</div><div><br></div><div id="composer_signature"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">---<div>Aki Tuomi</div><div>Dovecot oy</div></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Original message --------</div><div>From: Robert Gill <locke@sdf.lonestar.org> </div><div>Date: 13/09/2018 01:00 (GMT+02:00) </div><div>To: dovecot@dovecot.org </div><div>Subject: Server certificate verification error with Dovecot 2.3.2.1 </div><div><br></div></div>I'm attempting to upgrade my Dovecot installation to 2.3.2.1. My SSL<br>certificate authority provides a bundle containing their CA, plus<br>intermediate CAs, which I configure using the 'ssl_ca' option. The<br>comments in the configuration file say to only set this when you're<br>requiring client certificates, which I'm not, but fetchmail complains<br>with a "Server certificate verification error, Broken certificate chain"<br>error if that setting is not set. This works fine with Dovecot 2.2.34.<br><br>After upgrading to 2.3.2.1, fetchmail throws that error whether 'ssl_ca'<br>is set or not. Dovecot 2.3.2.1 reports the error<br><br> SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48<br> <br>in the logs when attempting the TLS handshake. The permissions on the CA<br>bundle haven't changed and should still be readable by Dovecot.<br><br>I'm running Gentoo Linux on x86_64 and mail is stored on an ext4 file<br>system. I'm attaching my config files for both Dovecot 2.2.34 and<br>Dovecot 2.3.2.1.<br></body></html>