<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Thank you for this. I am not using self-signed, I am using letsencrypt as a CA, the certs are installed where certbot put them.</p>
<p>I tried the example from https://wiki2.dovecot.org/TestInstallation, using openssl s_client, and I achieved the following (lots of data replaced with "...")</p>
<p>I have not changed anything else since your last reply, I am honestly not sure what rc config has to do with certs (google has not given me a result that seems to apply). Does the below help confirm my certs are properly installed and that i can connect to dovecot over tls and pass my credentials?</p>
<p>-----</p>
<p>root@mc:~ # openssl s_client -connect mydomain.com:143 -starttls imap<br />CONNECTED(00000004)<br />depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1<br />verify return:1<br />depth=1 C = US, O = Let's Encrypt, CN = R3<br />verify return:1<br />depth=0 CN = mydomain.com<br />verify return:1<br />---<br />Certificate chain<br /> ...<br />---<br />Server certificate<br />-----BEGIN CERTIFICATE-----<br />...<br />-----END CERTIFICATE-----<br />...<br />---<br />No client certificate CA names sent<br />Peer signing digest: SHA256<br />Peer signature type: RSA-PSS<br />Server Temp Key: X25519, 253 bits<br />---<br />SSL handshake has read 4922 bytes and written 426 bytes<br />Verification: OK<br />---<br />...<br />...<br />...<br />---<br />read R BLOCK<br />a login me@mydomain.com MyPass<br />* CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE<br />a OK Logged in<br />a OK Logged in<br />b select inbox<br />* FLAGS (\Answered \Flagged \Deleted \Seen \Draft)<br />* OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted.<br />* 35 EXISTS<br />* 0 RECENT<br />* OK [UNSEEN 18] First unseen.<br />* OK [UIDVALIDITY 1669149589] UIDs valid<br />* OK [UIDNEXT 255] Predicted next UID<br />* OK [HIGHESTMODSEQ 615] Highest<br />b OK [READ-WRITE] Select completed (0.001 + 0.000 secs).<br />c list "" *<br />* LIST (\HasNoChildren \Marked \Trash) "/" Trash<br />* LIST (\HasNoChildren \UnMarked \Junk) "/" Junk<br />* LIST (\HasNoChildren \Marked \Sent) "/" Sent<br />* LIST (\HasNoChildren \Drafts) "/" Drafts<br />* LIST (\HasNoChildren \UnMarked) "/" INBOX/email-reports<br />* LIST (\HasNoChildren \UnMarked) "/" INBOX/NAS-Alerts<br />* LIST (\HasChildren) "/" INBOX<br />c OK List completed (0.001 + 0.000 secs).</p>
<p><br /></p>
<div id="signature"></div>
<p><br /></p>
<p id="reply-intro">On 2022-11-23 14:49, PGNet Dev wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">i don't understand why it can't connect, this seems to work fine:</blockquote>
<br />fine ?<br /><br />you're manually overriding at least one problem with your certs/config<br /><br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">...<br />- Status: The certificate is NOT trusted. The name in the certificate does not match the expected.<br />*** PKI verification of server certificate failed...<br />Host 10.0.0.91 (sieve) has never been contacted before.<br />Its certificate is valid for 10.0.0.91.<br />Are you sure you want to trust it? (y/N): y<br />...</blockquote>
<br />it appears that you're using a self-signed cert? are your trusted certs defined and correctly chained? if not explicitly defined, did you correctly add you certs to system ssl dirs, and ensure hashes are correct?<br /><br />demonstrate first that you can connect to dovecot over tls with a cmd line client, without ignoring or overriding your cert problems<br /><br />including any client/server cert verification requirements you've turned on in dovecot config<br /><br />once you've passed the correct certs, then demonstrate that you can authenticate in the same session with any password/credentials you've set<br /><br />once that all works, make sure you've got those certs correctly set up in your rc config<br /><br /><br /></div>
</blockquote>
<img width="1" height="1" src="https://fcfjhji.r.bh.d.sendibt3.com/tr/op/knRzouEz9OtiAUmW0QJX2wTDj34YCxsntGD2nEwnMatUZd99gylYigzNf4zGELFOye3Qm9oqoGK3M_rTM4tX6f3t0S4qAntejXIZBN0IXIgHfmcbZITqeqmDIwzgUkk9gg5CsXJBFCD5Il7Qw38NSU0OUMmwF4jheBzgRqQMVqqy" alt="" /></body></html>