1

I have been trying to enable SSL on my courier IMAP server running Ubuntu 14.04. I installed courier-ssl and courier-imap-ssl. Then the server stopped working completely, with an "authentication error" in Rainloop webmail. This happens regardless of whether or not the courier-imap-ssl service is started, and is resolved if and only if courier-ssl is uninstalled.

What could be the problem here, and how would I go about enabling SSL?

With courier-ssl installed and courier-imap-ssl running, I get this error if I run openssl s_client -connect localhost:993:

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1463335379
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

And this error if I run telnet localhost 993:

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

2 Answers 2

0

I recommend to use openssl to connect to SSL services. Plain telnet is not able to communicate with encrypted connection:

openssl s_client -connect localhost:993

You can verify service by typing following command after establishing connection:

A login MYUSERNAME MYPASSWORD

Response should be:

A OK LOGIN Ok.

One option how to fix incorrect installation is to completely remove the service even with configuration:

apt-get remove --pure courier-imap-ssl

and reinstall it again.

Problems with SSL are often related to certificates and one reason could be that /etc/courier/dhparams.pem were not generated correctly. DH params could be regenerated by mkdhparams command.

0

The command you used to check courier only works with servers that immediately propose to switch to TLS:

openssl s_client -connect localhost:993

To test a mail service properly, when the mail service uses STARTTLS to switch to using TLS, then you need to add an option like this:

openssl s_client -connect localhost:993 -starttls imap

I have no clue about the status of the service in 14.04, but I used it in 18.04 and I could setup the TLS1 protocol and it would work.

Now with that last command, you will see exactly what TLS is supported. Since you mentioned courier, I tried all sorts of setups and I was not able to make it work with TLSv1.2. It seems to be limited to TLSv1. If that's what you're looking to get, then you'll want to switch to another server such as dovecot which is 99% compatible.

Not the answer you're looking for? Browse other questions tagged or ask your own question.