<!doctype html>
<html><head>
<meta charset="UTF-8">
</head><body><div><br></div><blockquote type="cite"><div>On 30/04/2020 14:49 <a href="mailto:hanasaki@gmail.com">hanasaki@gmail.com</a> <<a href="mailto:hanasaki@gmail.com">hanasaki@gmail.com</a>> wrote:</div><div><br></div><div><br></div><div>Recently thunderbird and Dovecot IMAPS cannot agree on SSL however</div><div>Evolution, on the exact same system, is working fine with the same</div><div>accounts. Tried recreating the Dovecot cert and also the thunderbird</div><div>accounts from scratch. The OpenSSL raw client works fine as well.</div><div><br></div><div>Would someone also confirm the openssl commands to create a selfsigned</div><div>cert for dovecot imaps. They cert created does work with evolution;</div><div>just not thunderbird.</div><div><br></div><div>Thoughts?</div><div><br></div><div>Apr 8 18:10:18 hh dovecot: imap-login: Debug: SSL error: SSL_accept()</div><div>failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad</div><div>certificate: SSL alert number 42</div><div>Apr 8 18:10:18 hh dovecot: imap-login: Disconnected (no auth attempts in</div><div>0 secs): user=<>, rip=000, lip=0000 TLS handshaking: SSL_accept()</div><div>failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad</div><div>certificate: SSL alert number 42, session=<--></div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x10, ret=1:</div><div>before SSL initialization</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>before SSL initialization</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1:</div><div>before SSL initialization</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>before SSL initialization</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>SSLv3/TLS read client hello</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>SSLv3/TLS write server hello</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>SSLv3/TLS write change cipher spec</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>TLSv1.3 write encrypted extensions</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>SSLv3/TLS write certificate</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>TLSv1.3 write server certificate verify</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>SSLv3/TLS write finished</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2001, ret=1:</div><div>TLSv1.3 early data</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1:</div><div>TLSv1.3 early data</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1:</div><div>TLSv1.3 early data</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1:</div><div>TLSv1.3 early data</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1:</div><div>TLSv1.3 early data</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL alert: where=0x4004,</div><div>ret=554: fatal bad certificate</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1:</div><div>error</div><div>Apr 8 18:10:19 hh dovecot: imap-login: Debug: SSL error: SSL_accept()</div><div>failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad</div><div>certificate: SSL alert number 42</div><div>Apr 8 18:10:19 firewall dovecot: imap-login: Disconnected (no auth</div><div>attempts in 0 secs): user=<>, rip=000, lip=00, TLS handshaking:</div><div>SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3</div><div>alert bad certificate: SSL alert number 42, session=<---></div><div><br></div><div>reference</div><div><a href="http://forums.debian.net/viewtopic.php?f=5&t=145849" rel="noopener" target="_blank">http://forums.debian.net/viewtopic.php?f=5&t=145849</a></div></blockquote><div><br></div><div>You are missing intermediate certs from your certfile. Put them after cert in order towards root.</div><div class="io-ox-signature"><pre>---
Aki Tuomi</pre></div></body></html>