dovecot - May 2020 - How to make IMAPS SSL Cert for Dovecot that works with Thunderbird

Hello all,

What are the instructions for making an SSL cert for Dovecot IMAPS?

Two methods have been tried, and work, with Evolution; however generate 
the following error when Thunderbird tries to connect.

Thank you,

method 1 : self signed
openssl req -newkey rsa:4096 -sha512 -x509 -days 365 -nodes -keyout 
mykey.key -out mycert.pem

method 2 : Let's Encrypt (LE) CA
Created with Certbot

ERROR
  TLS handshaking: SSL_accept() failed: error:14094412:SSL 
routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 
42, session=<+oooooo>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hanasaki.vcf
Type: text/x-vcard
Size: 4 bytes
Desc: not available
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20200524/0f399555/attachment.vcf>

From what I can tell, ?SSL alert number 42? means that you?ve configured Dovecot
to require client authentication.

Otherwise, your Let?s Encrypt certificate (with its authority chain) should
suffice.

-FG
> On May 24, 2020, at 5:45 PM, hanasaki at gmail.com wrote:
> 
> Hello all,
> 
> What are the instructions for making an SSL cert for Dovecot IMAPS?
> 
> Two methods have been tried, and work, with Evolution; however generate the
following error when Thunderbird tries to connect.
> 
> Thank you,
> 
> method 1 : self signed
> openssl req -newkey rsa:4096 -sha512 -x509 -days 365 -nodes -keyout
mykey.key -out mycert.pem
> 
> method 2 : Let's Encrypt (LE) CA
> Created with Certbot
> 
> ERROR
> TLS handshaking: SSL_accept() failed: error:14094412:SSL
routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42,
session=<+oooooo>
> <hanasaki.vcf>

Config has
	ssl_verify_client_cert = no
What options might have the client auth turned on?

TYIA

On 5/24/20 6:40 PM, Felipe Gasper wrote:
>  From what I can tell, ?SSL alert number 42? means that you?ve configured
Dovecot to require client authentication.
> 
> Otherwise, your Let?s Encrypt certificate (with its authority chain) should
suffice.
> 
> -FG
> 
>> On May 24, 2020, at 5:45 PM, hanasaki at gmail.com wrote:
>>
>> Hello all,
>>
>> What are the instructions for making an SSL cert for Dovecot IMAPS?
>>
>> Two methods have been tried, and work, with Evolution; however generate
the following error when Thunderbird tries to connect.
>>
>> Thank you,
>>
>> method 1 : self signed
>> openssl req -newkey rsa:4096 -sha512 -x509 -days 365 -nodes -keyout
mykey.key -out mycert.pem
>>
>> method 2 : Let's Encrypt (LE) CA
>> Created with Certbot
>>
>> ERROR
>> TLS handshaking: SSL_accept() failed: error:14094412:SSL
routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42,
session=<+oooooo>
>> <hanasaki.vcf>
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hanasaki.vcf
Type: text/x-vcard
Size: 4 bytes
Desc: not available
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20200524/8d5fb2a1/attachment.vcf>