So I still haven’t found a way to require client certificates only for port
993/IMAPS while leaving unencrypted IMAP open for local, trusted, services.
Is there really no way to do this? I just found out how to do the same thing
for postfix (turns out it’s fairly easy, just a matter of adding the settings
in the right parts of master.cf instead of main.cf), allowing me to restrict
client certificate verification to port 587 (I don’t accept port 465) without
interfering with incoming mail server connections on port 25.
> On 29 Jan 2016, at 13:00, Haravikk <dove...@haravikk.me> wrote:
>
>>
>> On 27 Jan 2016, at 21:55, Axel Luttgens <axel.luttg...@skynet.be> wrote:
>>
>> Hello Haravikk,
>>
>> Perhaps could you try to devise an exception based on one (or more) "remote"
>> section(s), as in:
>>
>> remote ip.of.webmail.server {
>> ssl_verify_client_cert = no
>> [other settings, if needed]
>> }
>>
>> But I guess you would need to combine this with inner protocol blocks, and
>> probably to replace the "protocol !smtp" block with less general settings.
>>
>> HTH,
>> Axel
>
> Thanks for the suggestion!
>
> Unfortunately the problem seems to be auth_ssl_require_client_cert; it can
> only be added to protocol blocks not to local or remote ones. Turning off
> ssl_verify_client_cert doesn’t seem to prevent dovecot from requiring a
> certificate if auth_ssl_require_client_cert is enabled (it may even force
> ssl_verify_client_cert to on implicitly, I’m not sure).
>
> It’s annoying because at present it seems like my only option would be to
> limit client certificates to POP3 and use that in my mail clients, allowing
> me to disable client certificates for IMAP to keep it free for Roundcube to
> use exclusively, but that’s not really an option.
