Displaying 20 results from an estimated 8000 matches similar to: "Upgrading to v2.3.X breaks ssl san?"
2019 Aug 07
1
Upgrading to v2.3.X breaks ssl san?
<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 07/08/2019 00:37 Joseph Tam via dovecot <
<a href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a>> wrote:
</div>
2019 Aug 08
1
Upgrading to v2.3.X breaks ssl san?
On Wed, 7 Aug 2019 20:24:13 +0300 (EEST), Aki Tuomi via dovecot wrote:
>> i thought ssl_ca is where to put the intermediate cert?
Well, it surely worked that way until v2.3...
> (Sorry for duplicate mail, keyboard acted up...)
>
> No, that has always been a mistake and it was fixed in 2.3. Our SSL
> pages in documentation & wiki have always recommended concatenating
>
2019 Aug 07
0
Upgrading to v2.3.X breaks ssl san?
> On 07/08/2019 14:28 telsch <telsch at gmx.de> wrote:
>
>
> with v2.2.34 i can use:
>
> ssl_ca = </etc/ssl/ca-bundle.pem
> ssl_cert = </etc/ssl-imap.pem
>
> after upgrade to v2.3.X it doesn't work like before.
>
> it's working if i manual cat ca-bundle.pem and ssl-imap.pem into one
> file and using only:
>
> ssl_cert =
2019 Aug 06
0
Upgrading to v2.3.X breaks ssl san?
On Tue, 6 Aug 2019, telsch wrote:
> if i cat ssl_ca and ssl_cert into one file and only use ssl_cert it's working with 2.3.X
> ssl_ca = </etc/ssl/ca-bundle.pem ssl_cert = </etc/ssl-imap.pem
In the words of Montoya, "I do not think it means what you think it
means", referring to "ssl_ca". That file is not used to to establish
the trust chain to your server
2018 May 28
3
SSL error after upgrading to 2.31
On 28.05.2018 14:30, Hauke Fath wrote:
> On Mon, 28 May 2018 13:52:01 +0300, Aki Tuomi wrote:
>> I'm sure. But putting it as ssl_ca makes no sense, since it becomes
>> confused what it is for.
> I guess - I haven't had a need for client certs, and only ever used
> ssl_ca for the server ca chain.
>
>> We can try restoring this as ssl_cert_chain setting in
2015 Sep 21
4
Dovecot proxy ignores trusted root certificate store
On Mon, 21 Sep 2015, Edgar Pettijohn wrote:
> doveconf -n?
doveconf -n|grep ssl should suffice:
ssl = required
ssl_ca = </usr/local/share/certs/ca-root-nss.crt
ssl_cert = </path/to/my/file.pem
ssl_key = </path/to/my/file.pem
ssl_require_crl = no
I'm using "ssl_ca = </usr/local/share/certs/ca-root-nss.crt" as a
temporary workaround, even though this is not what
2018 May 28
2
SSL error after upgrading to 2.31
On 28.05.2018 13:05, Hauke Fath wrote:
> On 05/28/18 11:08, Aki Tuomi wrote:
>>
>>
>> On 28.05.2018 12:06, Hauke Fath wrote:
>>> On 05/21/18 17:55, Aki Tuomi wrote:
>>>> ssl_ca is used only for validating client certificates.
>>>
>>> But it was used (though not documented, IIRC) for validating server
>>> certs, too. Since
2015 Oct 11
2
dovecot as proxy and verification of the backends certificate
Hello,
I'm using a dovecot as proxy, connecting to one or more backends.
The backends use X.509 certificates.
The proxy's passdb returns
extra fields:
user=foo
proxy
host=backend1.<domain>
ssl=yes
nopassword=y
Thus the proxy connects to the backend but can't verify the backends
certificate.
The following comment suggests using ssl_client_ca_file for
2017 Feb 03
3
Dovecot dsync 'ssl_client_ca'
Hello,
Still working with my dsync pb.
I have done a clone (vmware) of my email server.
Today I have two strictly identical emails servers (server1
(main) and server2 (bck) (except IP, hostname and mail_replica).
The ssl config on my both server:
ssl_protocols = !SSLv2 !SSLv3
ssl = required
verbose_ssl = no
ssl_key = </etc/ssl/private/private.key
ssl_cert =
2018 May 21
1
SSL error after upgrading to 2.31
After upgrading to 2.31 I'm getting this error. Not sure what I'm doing
wrong.
No (No signatures could be verified because the chain contains only one
certificate and it is not self signed.)
ssl = yes
ssl_cert = </etc/exim/certs/ctyme.com.crt
ssl_key = </etc/exim/certs/ctyme.com.key
ssl_ca = </etc/exim/certs/ca.crt
local mail.ctyme.com {
? protocol imap {
??? ssl_cert =
2017 Mar 20
2
Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings)
* Aki Tuomi <aki.tuomi at dovecot.fi>:
>
>
> On 20.03.2017 14:30, Ralf Hildebrandt wrote:
> > ssl_client_ca_file = </etc/ssl/certs/ca-certificates.crt
>
> Leave the < out. It is misleading, I know, but it does say file. =)
Makes no difference:
# doveconf |fgrep ssl_client_ca
ssl_client_ca_dir =
ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt
and with
2018 Dec 11
3
"no shared cypher", no matter what I try
hello, and some update
short version: the error is still there, but I have some more data to
share, thanks in advance for further advice
first, I am using Mutt 1.10.1 (2018-07-13) as mail client, so it is
not an obsolete version.
second... at the moment I can send email through postfix on the same
server, with the
same certificates (almost: I still have to fix some stuff, but is NOT
related to
2016 Apr 13
1
v2.3 development tree forked in git
The git master branch starts tracking Dovecot v2.3 development from now on. There are soon going to be several API changes there that might break plugins. If you wish to keep tracking latest v2.2.x development instead, switch to master-2.2 branch.
The nightly releases at http://dovecot.org/nightly/ will also track v2.3 tree.
2016 Apr 13
1
v2.3 development tree forked in git
The git master branch starts tracking Dovecot v2.3 development from now on. There are soon going to be several API changes there that might break plugins. If you wish to keep tracking latest v2.2.x development instead, switch to master-2.2 branch.
The nightly releases at http://dovecot.org/nightly/ will also track v2.3 tree.
2019 Apr 18
2
ssl_verify_server_cert against SAN?
2019 Apr 18
2
ssl_verify_server_cert against SAN?
2017 Feb 03
4
Dovecot dsync 'ssl_client_ca'
Hi,
I have made change:
ssl_protocols = !SSLv2 !SSLv3
ssl = required
verbose_ssl = no
ssl_key = </etc/ssl/private/private.key
ssl_cert = </etc/ssl/certs/key.crt
ssl_client_ca_file = </etc/ssl/certs/GandiCA2.pem
# Create a listener for doveadm-server
service doveadm {
user = vmail
inet_listener {
port = 12345
ssl= yes
}
}
and doveadm_port = 12345 // mail_replica =
2018 Sep 12
3
Server certificate verification error with Dovecot 2.3.2.1
I'm attempting to upgrade my Dovecot installation to 2.3.2.1. My SSL
certificate authority provides a bundle containing their CA, plus
intermediate CAs, which I configure using the 'ssl_ca' option. The
comments in the configuration file say to only set this when you're
requiring client certificates, which I'm not, but fetchmail complains
with a "Server certificate
2018 Nov 25
3
rspamd / imapsieve script is not executed/called
Hi to all of you,
as I am struggling around with this a week or so I'm afraid I have to ask
for help here.
The problem is sitting right in front of the computer, as most of the time.
;-)
So let me explain:
Dovecot is working properly for IMAP with LE certificates, so I thought
it's time to continue with Christoph Haas tutorial primarily and other
blogs and tutorials for setting up the
2018 Mar 19
3
v2.2.35 released
https://dovecot.org/releases/2.2/dovecot-2.2.35.tar.gz
https://dovecot.org/releases/2.2/dovecot-2.2.35.tar.gz.sig
??? - charset_alias: compile fails with Solaris Studio, reported by
??? ? John Woods.
??? - Fix local name handling in v2.2.34 SNI code, bug found by cPanel.
??? - imapc: Don't try to add mails to index if they already exist there.
??? - imapc: If email is modified in