thr3ads.net - dovecot - TLS not working with iOS beta? [Sep 2019]

If this information is useful, please help other people find it:
Share via:

Henrik Johansson

2019-Sep-08 09:42 UTC

TLS not working with iOS beta?

> On 4 Sep 2019, at 21:35, Jean-Daniel <jddupas at xooloo.com> wrote:
> 
> Just a wild guess as I didn?t try to configure Mail on Catalina yet, but it
looks like your server only supports ?DHE-RSA?? ciphers.
> I think that modern systems prefers using ECDHE key exchange and would not
be surprise if iOS requires it.
> 
Well I got the OpenSSL parts working now, but newer versions still refuses to
work after establishing with ECDHE, I just get no login attempts and no user:

imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>,
rip=55.66.77.88, lip=11.22.33.44, TLS, TLSv1.2 with cipher
ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

Regards
Henrik



Non working iOS 13

Sep 08 11:25:47 auth: Debug: auth client connected (pid=23934)
SeSep 08 11:25:47 auth: Debug: auth client connected (pid=23934)p 08 11:25:47
imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x10, ret=1: before/accept
initialization
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept
initialization
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept
initialization
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read
client hello A
SeSep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read
client hello A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
hello A
SSep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
hello A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server
hello A
SSep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server
hello A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write
certificate A
SSep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write
certificate A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key
exchange A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key
exchange A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server
done A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
certificate A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
Sep 08 11:25:47 imap-login: Debug: SSL: whereSep 08 11:25:47 imap-login: Debug:
SSL: where=0x2001, ret=1: SSLv3 write server done A =0x2002,Sep 08 11:25:47
imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
certificate A
Debug: SSL: where=0x2001, ret=1: SSLv3 flush data
Sep 08 1Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read
client key exchange A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
1:25Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read
client key exchange A
:Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
4Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
key exchange A
11:25:47 imap-login: Debug: SSL alert: close notify
Sep 08 11:Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3
read certificate verify A
25Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read
finished A
Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change
cipher spec A
:47 Sep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write
finished A
iSep 08 11:25:47 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data
map-Sep 08 11:25:47 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation
finished successfully
SSLv3 write key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: wherSep 08 11:25:47 imap-login: Debug:
SSL: where=0x2002, ret=1: SSL negotiation finished successfully e=0x2001,
ret=1:Sep 08 11:25:47 imap-login: Debug: SSL alert: close notify
Sep 08 11:25:47 imap-login: Info: Aborted login (no auth attempts in 0 secs):
user=<>, rip=55.66.77.88, lip=11.22.33.44, TLS, TLSv1.2 with cipher
ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits), session=<fU+qvQeSGTJb6jE9>
SSLvSep 08 11:25:47 imap-login: Debug: SSL alert: close notify


Working MacOS  10.14.6

Sep 08 11:24:09 auth: Debug: auth client connected (pid=23912)
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x10, ret=1: before/accept
initialization
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept
initialization
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read
client hello A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
hello A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server
hello A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write
certificate A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key
exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server
done A
ep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, reSep 08 11:24:09
imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
certificate A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
ep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client
key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client
key exchange A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read
certificate verify A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read
finished A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished
A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change
cipher spec A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write
finished A
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation
finished successfully
Sep 08 11:24:09 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation
finished successfully



-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20190908/f1f712eb/attachment.html>

LuKreme

2019-Sep-08 12:16 UTC

head link

TLS not working with iOS beta?

On Sep 8, 2019, at 03:48, Henrik Johansson <henrikj at henkis.net>
wrote:> Well I got the OpenSSL parts working now, but newer versions still refuses
to work after establishing with ECDHE, I just get no login attempts and no user:
iOS 13 definitely works with dovecot; it?s how I am able to send this mail.

-- 
My main job is trying to come up with new and innovative and effective ways to
reject even more mail. I'm up to about 97% now.

Aki Tuomi

2019-Sep-08 13:39 UTC

head link

TLS not working with iOS beta?

<!doctype html>
<html>
 <head> 
  <meta charset="UTF-8"> 
 </head>
 <body>
  <div>
   <br>
  </div>
  <blockquote type="cite">
   <div>
    On 08/09/2019 12:42 Henrik Johansson via dovecot <dovecot@dovecot.org>
wrote:
   </div>
   <div>
    <br>
   </div>
   <div>
    <br>
   </div>
   <br class="">
   <div>
    <br class="">
    <blockquote type="cite">
     <div class="">
      On 4 Sep 2019, at 21:35, Jean-Daniel <
      <a class=""
href="mailto:jddupas@xooloo.com">jddupas@xooloo.com</a>>
wrote:
     </div>
     <div class="">
      <br class="" style="caret-color: #000000; font-family:
Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing: 0px;
-webkit-text-stroke-width: 0px; text-decoration: none;">
      <span class="" style="caret-color: #000000; font-family:
Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing: 0px;
-webkit-text-stroke-width: 0px; text-decoration: none; float: none; display:
inline !important;">Just a wild guess as I didn’t try to configure Mail
on Catalina yet, but it looks like your server only supports ‘DHE-RSA…’
ciphers.</span>
      <br class="" style="caret-color: #000000; font-family:
Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing: 0px;
-webkit-text-stroke-width: 0px; text-decoration: none;">
      <span class="" style="caret-color: #000000; font-family:
Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing: 0px;
-webkit-text-stroke-width: 0px; text-decoration: none; float: none; display:
inline !important;">I think that modern systems prefers using ECDHE key
exchange and would not be surprise if iOS requires it.</span>
      <br class="" style="caret-color: #000000; font-family:
Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing: 0px;
-webkit-text-stroke-width: 0px; text-decoration: none;">
      <br class="" style="caret-color: #000000; font-family:
Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing: 0px;
-webkit-text-stroke-width: 0px; text-decoration: none;">
     </div>
    </blockquote>
    <br class="">
   </div>
   <div>
    Well I got the OpenSSL parts working now, but newer versions still refuses
to work after establishing with ECDHE, I just get no login attempts and no user:
   </div>
   <div>
    <br class="">
   </div>
   <div>
    imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>,
rip=55.66.77.88, lip=11.22.33.44, TLS, TLSv1.2 with cipher
ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
   </div>
   <div>
    <br class="">
   </div>
   <div>
    Regards
   </div>
   <div>
    Henrik
   </div>
   <div>
    <br class="">
   </div>
   <div>
    <br class="">
   </div>
   <div>
    <br class="">
   </div>
   <div></div>
  </blockquote>
  <div>
   <br>
  </div>
  <div>
   Ensure you have
  </div>
  <div>
   <br>
  </div>
  <div>
   auth_mechanisms=plain login
  </div>
  <div>
   <br>
  </div>
  <div>
   in your config.
  </div>
  <div class="io-ox-signature">
   <pre>---
Aki Tuomi</pre>
  </div> 
 </body>
</html>

Henrik Johansson

2019-Sep-08 14:10 UTC

head link

TLS not working with iOS beta?

> On 8 Sep 2019, at 15:39, Aki Tuomi <aki.tuomi at open-xchange.com>
wrote:
> 
>> 
>> On 08/09/2019 12:42 Henrik Johansson via dovecot <dovecot at
dovecot.org> wrote:
> 
> Ensure you have
> 
> auth_mechanisms=plain login
> 
> in your config.
That did it, must have changed it while debuting this and it continued to work
on MacOS but not iOS.

Thank you!

Regards
Henrik


-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20190908/749cadd4/attachment.html>

Reasonably Related Threads

Search for more apparently analagous threads

dovecot - Sep 2019 - TLS not working with iOS beta?

TLS not working with iOS beta?

TLS not working with iOS beta?

TLS not working with iOS beta?

TLS not working with iOS beta?

Reasonably Related Threads