dovecot - Jan 2022 - Received invalid SSL certificate: unable to get certificate CRL

Hi Laura,

On Mon, 24 Jan 2022 at 08:25:12PM +0000, Laura Smith
wrote:
> I'm having a frustrating problem trying to use "doveadm sync"
to pull
> mails off a server for migration purposes.
>
> # 2.3.17.1 (476cd46418): /etc/dovecot/dovecot.conf
> # Pigeonhole version 0.5.17.1 (a1a0b892)
> # OS: Linux 5.10.0-11-amd64 x86_64 Debian 11.2
>
> I have tried both explicit "ssl_client_ca_dir = /etc/ssl/certs"
and commenting it out (i.e. relying on OpenSSL default per the
> docs)
>
> I always get the same:
> Info: Received invalid SSL certificate: unable to get issuer certificate:
/C=US/O=Internet Security Research Group/CN=ISRG Root
> X1 (check ssl_client_ca_* se
> ttings?)
just an idea, but maybe that's the problem?:

https://doc.dovecot.org/configuration_manual/authentication/proxies/

"Note
ssl_client_ca_dir or ssl_client_ca_file aren?t currently used for verifying the
remote certificate, although ideally they will be in a future Dovecot version.
For
now you need to add the trusted remote certificates to ssl_ca."

Regards,
Markus

> just an idea, but maybe that's the problem?:
>
> https://doc.dovecot.org/configuration_manual/authentication/proxies/
>
> "Note
>
> ssl_client_ca_dir or ssl_client_ca_file aren?t currently used for verifying
the
>
> remote certificate, although ideally they will be in a future Dovecot
version. For
>
> now you need to add the trusted remote certificates to ssl_ca."
>
Hi Markus

Thanks for your suggestion, I have a couple of questions about it though.

First, my understanding from the docs was that ssl_client_ca_* were override
parameters and that in the absence of the parameters, Dovecot would default to
using OpenSSL defaults ? (And building on that, as per my manual tests, you can
see OpenSSL returns an "OK" on the validation).

Second, I'm dealing with standard Let's Encrypt certs here, no private
PKI certs here.

Laura

For the benefit of list, I've decided to work-around the problem using:

imapc_ssl_verify = no

Obviously I still welcome suggestions as to how I can get dsync working with
Let's Encrypt certificates and when OpenSSL validates "ok" but
Dovecot does not (despite Dovecot supposedly falling-back to OpenSSL).

For the record, I have done this sort of dsync before (i.e. "dsync
backup" from source that has Let's Encrypt cert), I've never had a
problem before, so I'm wondering if it's something peculiar to Dovecot
2.3.17.1 (whether a bug or a feature, it would be nice to know what's
changed since I would have thought this sort of scenario should work "out
of the box").