0

i have been trying to configure my dovecot imap server (version 1.0.10 - upgrading is not an option at this stage) with a new ssl certificate on ubuntu like so:

$ grep ^ssl /etc/dovecot/dovecot.conf
ssl_disable = no
ssl_cert_file = /etc/ssl/certs/mydomain.com.crt.20120904
ssl_key_file = /etc/ssl/private/mydomain.com.key.20120904
$ /etc/init.t/dovecot stop
$ sudo dovecot -p
$ [i enter the ssl password here]

it doesn't show any errors and when i run ps aux | grep dovecot i get

root     21368  0.0  0.0  12452   688 ?        Ss   15:19   0:00 dovecot -p
root     21369  0.0  0.0  71772  2940 ?        S    15:19   0:00 dovecot-auth
dovecot  21370  0.0  0.0  14140  1904 ?        S    15:19   0:00 pop3-login
dovecot  21371  0.0  0.0  14140  1900 ?        S    15:19   0:00 pop3-login
dovecot  21372  0.0  0.0  14140  1904 ?        S    15:19   0:00 pop3-login
dovecot  21381  0.0  0.0  14280  2140 ?        S    15:19   0:00 imap-login
dovecot  21497  0.0  0.0  14280  2116 ?        S    15:29   0:00 imap-login
dovecot  21791  0.0  0.0  14148  1908 ?        S    15:48   0:00 imap-login
dovecot  21835  0.0  0.0  14148  1908 ?        S    15:53   0:00 imap-login
dovecot  21931  0.0  0.0  14148  1904 ?        S    16:00   0:00 imap-login
me       21953  0.0  0.0   5168   944 pts/0    S+   16:02   0:00 grep --color=auto dovecot

which looks like it is all running fine. so then i test to see if i can telnet to the dovecot server, and this works fine:

$ telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK Dovecot ready.

but when i test whether dovecot has configured the ssl certificates properly, it appears to fail:

$ sudo openssl s_client -connect localhost:143 -starttls imap
CONNECTED(00000003)
depth=0 /description=xxxxxxxxxxxxxxxxx/C=AU/ST=xxxxxxxx/L=xxxx/O=xxxxxx/CN=*.mydomain.com/[email protected]
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /description=xxxxxxxxxxx/C=AU/ST=xxxxxx/L=xxxx/O=xxxx/CN=*.mydomain.com/[email protected]
verify error:num=27:certificate not trusted
verify return:1
depth=0 /description=xxxxxxxx/C=AU/ST=xxxxxxxxxx/L=xxxx/O=xxxxx/CN=*.mydomain.com/[email protected]
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/description=xxxxxxxxxxxx/C=AU/ST=xxxxxxxxxx/L=xxxxxxxx/O=xxxxxxx/CN=*.mydomain.com/[email protected]
   i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 2 Primary Intermediate Server CA
---
Server certificate
-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxx
.
.
.
xxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxx==
-----END CERTIFICATE-----
subject=/description=xxxxxxxxxx/C=AU/ST=xxxxxxxxx/L=xxxxxxx/O=xxxxxx/CN=*.mydomain.com/[email protected]
issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 2 Primary Intermediate Server CA
---
No client certificate CA names sent
---
SSL handshake has read 2831 bytes and written 342 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: xxxxxxxxxxxxxxxxxxxx
    Session-ID-ctx: 
    Master-Key: xxxxxxxxxxxxxxxxxx
    Key-Arg   : None
    Start Time: 1351661960
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
. OK Capability completed.

at least, i'm assuming this is a failure???

3 Answers 3

1

The problem is with openssl, not dovecot.

There is a bug in openssl which stops it looking for the default CApath, so you need to tell it where to find the list of root CA certs by adding -CApath to your command line. For example:

sudo openssl s_client -connect localhost:143 -starttls imap -CApath /dev/null 

If you have not populated your certs folder yet and you are computer literate, then follow this tutorial to download certdata.txt from Mozilla and generate the necessary PEM files and symlinks. The scripts may need modifying if you do not have access to /bin and you will need to create a symlink ln -s ca-bundle.crt cert.pem.

(Specifying /dev/null forces openssl to use the default path of cert.pem in your openssl directory. To find out where your openssl directory is, type openssl version -d).

Since you are using StartSSL, you may need to concatenate your certificate and their intermediate certificate for dovecot, in your case StartCom Class 2 Primary Intermediate Server CA. Their free certificate uses StartCom Class 1 Primary Intermediate Server CA

1
  • excellent :) i ran through the tutorial and now when run the openssl... command i get Verify return code: 0 (ok). to cat the certificates do i just go cat /etc/ssl/certs/mydomain.com.crt.20120904 /etc/ssl/certs/mydomain.com.intermediate.20120904.pem > /etc/ssl/certs/mydomain.com.crt.20120904? of course i will save the original crt just in case... Nov 2, 2012 at 5:31
0

You may use verbose_ssl = yes in the dovecot configuration to produce additional logging output.

In my configuration (dovecot 2.0) I use the following statements:

 ssl_cert = </etc/ssl/certs/mydomain.com.crt.20120904
 ssl_key = </etc/ssl/private/mydomain.com.key.20120904
2
  • thanks for the attempt but that's definitely not the problem. here is what happens when i change it to this: Error: Error in configuration file /etc/dovecot/dovecot.conf line 96: Unknown setting: ssl_cert Fatal: Invalid configuration in /etc/dovecot/dovecot.conf Nov 1, 2012 at 4:00
  • Right, now I see you are using dovecot 1.0.
    – user86064
    Nov 1, 2012 at 9:44
0

Old question - new problems (Letsencrypt certs this time):
"Verify return code: 21 (unable to verify the first certificate)"
(meaning the Intermediate Certificate (chain) is not being found/used to verify)

Here is the solution I found after much trial and error over the last 24 hours.

First let me preface what I used for testing:
I have Dovecot on another email server (Ubuntu 18.xx) and it has the SAME Dovecot local.conf settings other than domains/certificates used. Both use Letsencrypt certificates and both were renewed yesterday.

The Dovecot (version 2.2.33.2) on Ubuntu 18 works perfectly.
No error codes using openssl s_client to test email ports :993/IMAP or :995/POP.

But, on another machine (the one showing the error) I use:

OS: Ubuntu 20.04.2
Dovecot (Ubuntu default/repo version): 2.3.7.2 (3c910f64b)
OpenSSL (Ubuntu default/repo version): 1.1.1f 31 Mar 2020

The error came to my attention after I had a customer complain about adding an email account to an Android phone (Google/Gmail default email app):

"Certificate cannot be trusted."

If I use the cert for web or smtp the openssl test works fine and verifies.
This leads me to believe the issue is with Dovecot on Ubuntu 20.

Other email clients like Thunderbird and Outlook also work fine.

I immediately decided to test with 'openssl s_client' and the error brought me here eventually.

My config looked like this on both the broken and working dovecot machines:

 ssl_ca = </etc/letsencrypt/live/{CertName}/fullchain.pem
 ssl_cert = </etc/letsencrypt/live/{CertName}/cert.pem
 ssl_key  = </etc/letsencrypt/live/{CertName}/privkey.pem

I have not determined what software causes the error, but I have cleared the error. The Android phone now trusts the certificate fully. Going in I knew the error was probably caused by the lack of verification of the certificate chain / CA.

Solution/TL;DR:

Use the fullchain.pem as your certificate entry (ssl_cert =). It contains both your LE cert and chain.

Your Dovecot configuration for SSL should look like this (replace {CertName} with your own, obviously):

 ssl_ca = </etc/letsencrypt/live/{CertName}/chain.pem  (or 'fullchain' should work)
 ssl_cert = </etc/letsencrypt/live/{CertName}/fullchain.pem
 ssl_key  = </etc/letsencrypt/live/{CertName}/privkey.pem

You should not see the error anymore during testing:

 Verify return code: 0 (ok)

I didn't need to change anything on the machine not showing the error (Ubuntu 18) - so I didn't.

Update:
Dovecot being used currently with Ubuntu 20 repository/apt is/was affected.
Bug reference: https://dovecot.org/pipermail/dovecot/2021-April/121884.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .