thr3ads.net - dovecot - Problem with TLS and Outlook 2010 [Dec 2014]

If this information is useful, please help other people find it:
Share via:

Wayne Andersen

2014-Dec-11 23:06 UTC

Problem with TLS and Outlook 2010

Dovecot 2.0.9

 

So I am trying to get my Outlook 2010 client to use TLS with Dovecot.

The Outlook error that I get is: 

 

Log onto incoming mail server (IMAP): A secure connection to the server
cannot be established.

I have set the port to 143,993,995 none of them work, and the security to
TLS.

 

I have all of the certificates in the full chain installed on my machine and
when viewing them they all show ?This certificate is OK.?

 

I have turned on Outlook logging and am seeing this:

 

C:\PROGRA~2\MICROS~2\Office14\OUTLMIME.DLLIMAP: 14:48:40 [db] 

 

Intializing connection [131383B0]

 

IMAP: 14:48:40 [db] Setting internal codepage to 1200

 

IMAP: 14:48:40 [db] Connecting to 'mail.mydomain.com' on port 143.

IMAP: 14:48:40 [db] OnNotify: asOld = 0, asNew = 2, ae = 0

IMAP: 14:48:40 [db] srv_name = "mail.mydomain.com" srv_addr
174.46.198.101:143

IMAP: 14:48:40 [db] OnNotify: asOld = 2, asNew = 3, ae = 1

IMAP: 14:48:40 [db] OnNotify: asOld = 3, asNew = 4, ae = 0

IMAP: 14:48:40 [db] OnNotify: asOld = 4, asNew = 5, ae = 2

IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 5, ae = 4

IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 5, ae = 3

IMAP: 14:48:40 [rx] * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE
AUTH=PLAIN AUTH=LOGIN] Dovecot ready.    ?----- not seeing the STARTTLS
capability here.

IMAP: 14:48:40 [tx] sx59 CAPABILITY

IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 5, ae = 3

IMAP: 14:48:40 [rx] * CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE AUTH=PLAIN
AUTH=LOGIN

IMAP: 14:48:40 [rx] sx59 OK Capability completed.

IMAP: 14:48:40 [db] ERROR: "A secure connection to the server cannot be
established.", hr=0x800CCCE1

IMAP: 14:48:40 [db] Connection to 'mail.mydomain.com' closed.

IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 0, ae = 5

 

 
>From a windows 7 client if I do a telnet mail.mydomain.com 143 I get:
* OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN]
Dovecot ready. ?---  do not see STARTTLS in the capability list.

 

Same windows client:

C:\OpenSSL-Win64\bin>openssl.exe s_client -connect mail.mydomain.com:993

WARNING: can't open config file: /usr/local/ssl/openssl.cnf

Loading 'screen' into random state - done

CONNECTED(0000018C)

depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited,
CN = COMODO RSA Certification Authority

verify error:num=20:unable to get local issuer certificate  ?--- Yes I see
this and it may be an issue, but this certificate exist and is valid.

verify return:0

---

Certificate chain

0 s:/OU=Domain Control Validated/OU=COMODO SSL Wildcard/CN=*.mydomain.com

   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Domain Validation Secure Server CA

1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Domain Validation Secure Server CA

   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Certification Authority

2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Certification Authority

   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust
External CA Root

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIFVjCCBD6gAwIBAgIQWCEHgEVoKToQkXoG3+g1cTANBgkqhkiG9w0BAQsFADCB

kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G




fs2e2XCjkEVu/YR7exKkmTf9wkhZ+tD0+S8
-----END CERTIFICATE-----

subject=/OU=Domain Control Validated/OU=COMODO SSL
Wildcard/CN=*.mydomain.com

issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO
RSA Domain Validation Secure Server CA

---

No client certificate CA names sent

---

SSL handshake has read 5169 bytes and written 497 bytes

---

New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : DHE-RSA-AES256-GCM-SHA384

    Session-ID:
281D21C81FA6E7656B9CA2BD13590DDE0094CC8FA43FFD31DFEEDEC74F2511BF

    Session-ID-ctx:

    Master-Key:
AF36CFDBBAA955270A48E2E9740F671299511DA1B3EEAFFAEC582E100DE519EC7CBC612ED686
DBBBFE06B9D6E535B837

    Key-Arg   : None

    PSK identity: None

    PSK identity hint: None

    SRP username: None

    TLS session ticket lifetime hint: 300 (seconds)

    TLS session ticket:

    0000 - 1d 2a e7 fd 94 9d a2 84-90 52 32 2f e7 89 28 59
.*.......R2/..(Y

    0010 - 12 d5 b3 56 0e a7 71 c4-84 53 01 ec 95 97 59 4e
...V..q..S....YN

    0020 - ac 17 3f 3f dc b6 b0 db-0f 47 0c 88 5a c2 7b a7
..??.....G..Z.{.

    0030 - d0 73 ff 19 ec 6f cd 67-d5 58 3e cd 91 eb 79 90
.s...o.g.X>...y.

    0040 - 76 a9 d9 f2 17 dc da c4-bd ba 69 b4 11 c7 65 f9
v.........i...e.

    0050 - 71 42 01 3b bd 6f a5 3a-9f 34 48 36 9e 31 4e 1c
qB.;.o.:.4H6.1N.

    0060 - 93 24 75 7f 8a c6 7f 7a-4c cd 93 bd 92 4c 9d 7f
.$u....zL....L..

    0070 - df 47 11 3e 93 11 73 8e-09 5c ef 85 e2 aa bc 77
.G.>..s..\.....w

    0080 - eb 29 fa c6 30 5b 27 de-50 98 47 7b 55 f0 84 91
.)..0['.P.G{U...

    0090 - 97 da 66 29 1c c9 7e 63-56 8b a7 80 57 4b 2f 2c
..f)..~cV...WK/,

 

    Start Time: 1418336961

    Timeout   : 300 (sec)

    Verify return code: 20 (unable to get local issuer certificate)

---

* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

e logout

closed

 

 

 

 
>From a linux client I get :
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

I do see STARTTLS  here.

 
>From a linux client:
openssl s_client -connect localhost:993

 

CONNECTED(00000003)

depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN AddTrust
External CA Root

verify return:1

depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited,
CN = COMODO RSA Certification Authority

verify return:1

depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited,
CN = COMODO RSA Domain Validation Secure Server CA

verify return:1

depth=0 OU = Domain Control Validated, OU = COMODO SSL Wildcard, CN
*.mydomain.com

verify return:1

---

Certificate chain

0 s:/OU=Domain Control Validated/OU=COMODO SSL Wildcard/CN=*.mydomain.com

   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Domain Validation Secure Server CA

1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Domain Validation Secure Server CA

   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Certification Authority

2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Certification Authority

   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust
External CA Root

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIFVjCCBD6gAwIBAgIQWCEHgEVoKToQkXoG3+g1cTANBgkqhkiG9w0BAQsFADCB




fs2e2XCjkEVu/YR7exKkmTf9wkhZ+tD0+S8
-----END CERTIFICATE-----

subject=/OU=Domain Control Validated/OU=COMODO SSL
Wildcard/CN=*.mydomain.com

issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO
RSA Domain Validation Secure Server CA

---

No client certificate CA names sent

---

SSL handshake has read 5169 bytes and written 453 bytes

---

New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : DHE-RSA-AES256-GCM-SHA384

    Session-ID:
8357FF1D37476EEF1BE64DE443EFFBBED9CE375EA8CA5F1C5ED628B52E723D8F

    Session-ID-ctx:

    Master-Key:
D6906D40FF47E7ED278AF4D0B143407A53955DA97365A09881EA0C68AAF3B879CB3136A7783B
18A46FD0A0634CBDC17D

    Key-Arg   : None

    Krb5 Principal: None

    PSK identity: None

    PSK identity hint: None

    TLS session ticket lifetime hint: 300 (seconds)

    TLS session ticket:

    0000 - cb 06 13 9a c9 2a 67 b7-3d 5b 5b 33 3b fe 1e 2e
.....*g.=[[3;...

    0010 - 18 73 2d ae 9e 4d f3 69-aa 13 ca 9c 07 94 73 cb
.s-..M.i......s.

    0020 - 02 a2 74 c9 df 70 ed 1b-33 f8 fb cb 97 1d 12 f5
..t..p..3.......

    0030 - 88 21 4e fd 7e be 69 b8-88 30 c9 99 70 f4 ea f3
.!N.~.i..0..p...

    0040 - b0 90 c8 ab a6 f4 e5 37-c8 3e 4e 33 24 f9 cd 37
.......7.>N3$..7

    0050 - f8 b0 8a 9a f3 44 39 27-e3 3d 96 3b ba a2 4e 85
.....D9'.=.;..N.

    0060 - 77 5f a7 f7 6e 12 76 59-51 94 da 63 dd 99 cc 74
w_..n.vYQ..c...t

    0070 - 1b 1b 1f 33 02 5f 3d ed-9a 57 e8 63 87 d4 8f d5
...3._=..W.c....

    0080 - d5 fc 8c bf 89 4d 4d 91-bc 4f c7 67 79 c4 ec e9
.....MM..O.gy...

    0090 - 47 68 0f 21 47 58 8a c9-10 a0 3b 46 e9 3b 08 cb
Gh.!GX....;F.;..

 

    Start Time: 1418337012

    Timeout   : 300 (sec)

    Verify return code: 0 (ok)

---

* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

e logout

closed

 

 

 

doveconf ?n | grep ssl

 

# 2.0.9: /etc/dovecot/dovecot.conf

ssl_cert = </etc/pki/dovecot/certs/dovecot.pem

ssl_cipher_list = ALL:!LOW:!SSLv3:!SSLv2:!EXP:!aNULL

ssl_key = </etc/pki/dovecot/private/dovecot.key

Oscar del Rio

2014-Dec-15 17:52 UTC

head link

Problem with TLS and Outlook 2010

On 12/11/14 06:06 PM, Wayne Andersen wrote:>  From a windows 7 client if I do a telnet mail.mydomain.com 143 I get:
>
> * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN]
> Dovecot ready. ?---  do not see STARTTLS in the capability list.
>
>
>
>  From a linux client I get :
>
> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
> STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
>
> I do see STARTTLS  here.
>
It looks like they are connecting to different servers.
DNS or proxy problem?
Did you check the server logs?

Steffen Kaiser

2014-Dec-16 07:29 UTC

head link

Problem with TLS and Outlook 2010

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 11 Dec 2014, Wayne Andersen wrote:
> Log onto incoming mail server (IMAP): A secure connection to the server
> cannot be established.
>
> I have set the port to 143,993,995 none of them work, and the security to
> TLS.
993 is IMAP-over-SSL, which is probably not named "TLS", but
"SSL" in
Outlook.
Usually "TLS" means to use STARTTLS.
See: http://www.cs.umd.edu/faq/mailclient/outlook.html
But there are a lot of different Outlook versions and different names for 
settings.
> IMAP: 14:48:40 [db] srv_name = "mail.mydomain.com" srv_addr >
174.46.198.101:143
is this IP correct?
> IMAP: 14:48:40 [rx] * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE
> AUTH=PLAIN AUTH=LOGIN] Dovecot ready.    ?----- not seeing the STARTTLS
> capability here.
Do you have a local Firewall or a Cisco-Router between this client and the 
server? Some firewalls filter out STARTTLS in order to scan the 
transferred content.
> C:\OpenSSL-Win64\bin>openssl.exe s_client -connect mail.mydomain.com:993
>
> verify error:num=20:unable to get local issuer certificate  ?--- Yes I see
> this and it may be an issue, but this certificate exist and is valid.
openssl does not guess certificates, you need to specify them on command 
line.
> ---
> From a linux client I get :
>
> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
> STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
>
> I do see STARTTLS  here.
does this client run in the same network as the windows client?

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBVI/fZHz1H7kL/d9rAQJivAgAiatTp5CXbTEwKMN5HTHvN9B4BB3sIN99
P8adumkEAZ5AZVIRSfmWvhGf77jsyC5/Rxc/R2OuqY+hLUkyU0svu6OqhNMEgXrR
hA9PFUp3MXj4FBzxkFMOC/RKdzyClNuPEAAwUU/IvZugRhF95C9+5fa66rKIXgDl
/s5eKhcml9M1Zx4qK0336XmV6W0VXXiOJM1YBSwUt/yq0NseUuyDE6+FS50z+5kL
lIk7BRf3p/pJC8hUBJmtVu67S0ZSUD6i9kYbuKvpd7bAfWDOMtXDZTRl8VoEVJWg
QXz7fF1FPy7KqEo67gthkMwwTeXeN6tHm0cpgu53FnXZEVSKR+nuuQ==VHS1
-----END PGP SIGNATURE-----

Wayne Andersen

2014-Dec-16 17:09 UTC

head link

Problem with TLS and Outlook 2010

Thank you, see my answers below.
> -----Original Message-----
> From: Steffen Kaiser [mailto:skdovecot at smail.inf.fh-brs.de]
> Sent: Tuesday, December 16, 2014 12:30 AM
> To: Wayne Andersen
> Cc: dovecot at dovecot.org
> Subject: Re: Problem with TLS and Outlook 2010
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Thu, 11 Dec 2014, Wayne Andersen wrote:
> 
> > Log onto incoming mail server (IMAP): A secure connection to the
> > server cannot be established.
> >
> > I have set the port to 143,993,995 none of them work, and the security
> > to TLS.
> 
> 993 is IMAP-over-SSL, which is probably not named "TLS", but
"SSL" in
> Outlook.
> Usually "TLS" means to use STARTTLS.
> See: http://www.cs.umd.edu/faq/mailclient/outlook.html
> But there are a lot of different Outlook versions and different names for
> settings.
> 
My preference is STARTTLS, which I assumed I would get by selecting port 143
and TLS.
> > IMAP: 14:48:40 [db] srv_name = "mail.mydomain.com" srv_addr
> > 174.46.198.101:143
> 
> is this IP correct?
> 
Yes, it is correct.
> > IMAP: 14:48:40 [rx] * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE
> > AUTH=PLAIN AUTH=LOGIN] Dovecot ready.    ?----- not seeing the
> STARTTLS
> > capability here.
> 
> Do you have a local Firewall or a Cisco-Router between this client and the
> server? Some firewalls filter out STARTTLS in order to scan the
transferred> content.
> 
No, all of these machines are on a local subnet.
> > C:\OpenSSL-Win64\bin>openssl.exe s_client -connect
> > mail.mydomain.com:993
> >
> > verify error:num=20:unable to get local issuer certificate  ?--- Yes I
> > see this and it may be an issue, but this certificate exist and is
valid.> 
> openssl does not guess certificates, you need to specify them on command
> line.
> 
I am not sure I understand this. Dovecot has the certificate chain, which it
should send to the client if I understand correctly. 
There may be an issue with the format of the certificate chain file, but if
there is I don?t know how to fix it.
> > ---
> > From a linux client I get :
> >
> > * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID
> ENABLE
> > IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
> >
> > I do see STARTTLS  here.
> 
> does this client run in the same network as the windows client?
> 
Yes, same local subnet, in fact the Linux client is a virtual machine
running on the same machine as the windows client.
> - --
> Steffen Kaiser
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> 
> iQEVAwUBVI/fZHz1H7kL/d9rAQJivAgAiatTp5CXbTEwKMN5HTHvN9B4BB3sIN
> 99
> P8adumkEAZ5AZVIRSfmWvhGf77jsyC5/Rxc/R2OuqY+hLUkyU0svu6OqhNME
> gXrR
> hA9PFUp3MXj4FBzxkFMOC/RKdzyClNuPEAAwUU/IvZugRhF95C9+5fa66rKIXg
> Dl
> /s5eKhcml9M1Zx4qK0336XmV6W0VXXiOJM1YBSwUt/yq0NseUuyDE6+FS50z
> +5kL
> lIk7BRf3p/pJC8hUBJmtVu67S0ZSUD6i9kYbuKvpd7bAfWDOMtXDZTRl8VoEVJ
> Wg
> QXz7fF1FPy7KqEo67gthkMwwTeXeN6tHm0cpgu53FnXZEVSKR+nuuQ=> =VHS1
> -----END PGP SIGNATURE-----

Possibly Parallel Threads

Search for more apparently analagous threads

dovecot - Dec 2014 - Problem with TLS and Outlook 2010

Problem with TLS and Outlook 2010

Problem with TLS and Outlook 2010

Problem with TLS and Outlook 2010

Problem with TLS and Outlook 2010

Possibly Parallel Threads