Re: [Dovecot] SSL with startssl.com certificates

2013-10-10 Thread Dan Langille
On Oct 10, 2013, at 2:26 PM, Dan Langille wrote: > On Oct 9, 2013, at 11:43 PM, Noel Butler wrote: > >> On 10/10/2013 13:36, Noel Butler wrote: >>> I can't recall if we previously discussed it, but, why the fascination >>> with imaps, why not use TLS on 143, or wont that connect either? tried >>>

Re: [Dovecot] SSL with startssl.com certificates

2013-10-10 Thread Dan Langille
On Oct 9, 2013, at 11:43 PM, Noel Butler wrote: > On 10/10/2013 13:36, Noel Butler wrote: >> I can't recall if we previously discussed it, but, why the fascination >> with imaps, why not use TLS on 143, or wont that connect either? tried >> pop3 TLS ? pop3s? >> and when you test, use -CAfile /path

Re: [Dovecot] SSL with startssl.com certificates

2013-10-10 Thread Dan Langille
On Oct 9, 2013, at 11:36 PM, Noel Butler wrote: > I can't recall if we previously discussed it, but, why the fascination with > imaps, why not use TLS on 143, or wont that connect either? Yes, neither TLS nor IMAPS will connect. > tried pop3 TLS ? pop3s? I have not. My next step will be sett

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Noel Butler
On 10/10/2013 13:36, Noel Butler wrote: I can't recall if we previously discussed it, but, why the fascination with imaps, why not use TLS on 143, or wont that connect either? tried pop3 TLS ? pop3s? and when you test, use -CAfile /path/to/(startssl's)CA.pem I see no auth mech statement, so usi

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Noel Butler
I can't recall if we previously discussed it, but, why the fascination with imaps, why not use TLS on 143, or wont that connect either? tried pop3 TLS ? pop3s? and when you test, use -CAfile /path/to/(startssl's)CA.pem I see no auth mech statement, so using hte default is limited, IIRC, login

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Dan Langille
On Oct 9, 2013, at 6:33 PM, Noel Butler wrote: > On 10/10/2013 06:09, Eliezer Croitoru wrote: > >> I would imaging that 4k bits certificate handshake and validation can >> take more then 1 sec.. >> Am I right about it? > > hardly > > and the size is not his problem. > > he was given a test acc

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Noel Butler
On 10/10/2013 06:09, Eliezer Croitoru wrote: I would imaging that 4k bits certificate handshake and validation can take more then 1 sec.. Am I right about it? hardly and the size is not his problem. he was given a test account on my network when I last saw this thread (few weeks back?), th

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Reindl Harald
Am 09.10.2013 23:09, schrieb Eliezer Croitoru: > On 10/09/2013 11:15 PM, Reindl Harald wrote: >> why in the world should it take more than 1 second? >> and even if - how does this matter? > The dovecot daemon waited only 1 second for responnse.. says who? the *client* closed the connection with

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Eliezer Croitoru
On 10/09/2013 11:15 PM, Reindl Harald wrote: why in the world should it take more than 1 second? and even if - how does this matter? The dovecot daemon waited only 1 second for responnse.. and if there is a 900 Mhz client like many devices that uses android how long it would take to encypt end

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Reindl Harald
Am 09.10.2013 22:09, schrieb Eliezer Croitoru: > On 10/09/2013 10:55 PM, Reindl Harald wrote: >> >> >> Am 09.10.2013 21:45, schrieb Eliezer Croitoru: >>> On 10/09/2013 10:31 PM, Reindl Harald wrote: Am 09.10.2013 21:27, schrieb Eliezer Croitoru: > On 09/13/2013 02:59 PM, Dan Lang

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Eliezer Croitoru
On 10/09/2013 10:55 PM, Reindl Harald wrote: Am 09.10.2013 21:45, schrieb Eliezer Croitoru: On 10/09/2013 10:31 PM, Reindl Harald wrote: Am 09.10.2013 21:27, schrieb Eliezer Croitoru: On 09/13/2013 02:59 PM, Dan Langille wrote: *** /var/log/maillog *** Sep 13 11:50:46 imaps dovecot: imap

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Reindl Harald
Am 09.10.2013 21:45, schrieb Eliezer Croitoru: > On 10/09/2013 10:31 PM, Reindl Harald wrote: >> >> >> Am 09.10.2013 21:27, schrieb Eliezer Croitoru: >>> On 09/13/2013 02:59 PM, Dan Langille wrote: *** /var/log/maillog *** Sep 13 11:50:46 imaps dovecot: imap-login: Warning: SSL fai

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Eliezer Croitoru
On 10/09/2013 10:31 PM, Reindl Harald wrote: Am 09.10.2013 21:27, schrieb Eliezer Croitoru: On 09/13/2013 02:59 PM, Dan Langille wrote: *** /var/log/maillog *** Sep 13 11:50:46 imaps dovecot: imap-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [166.137.84.11] Sep 1

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Reindl Harald
Am 09.10.2013 21:27, schrieb Eliezer Croitoru: > On 09/13/2013 02:59 PM, Dan Langille wrote: >> >> *** /var/log/maillog *** >> Sep 13 11:50:46 imaps dovecot: imap-login: Warning: SSL failed: >> where=0x2002: SSLv3 read client certificate A [166.137.84.11] >> Sep 13 11:50:46 imaps dovecot: imap-lo

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Eliezer Croitoru
On 09/13/2013 02:59 PM, Dan Langille wrote: *** /var/log/maillog *** Sep 13 11:50:46 imaps dovecot: imap-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [166.137.84.11] Sep 13 11:50:46 imaps dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=16

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Reindl Harald
Am 09.10.2013 21:06, schrieb Dan Langille: > On Oct 6, 2013, at 5:06 PM, Reindl Harald wrote: >> and mail.app is working even with *self signed* certificates and dovecot 2.2 >> you only have to accept / import the certificate >> proven by a testserver all day long > > It seems that the test serve

Re: [Dovecot] SSL with startssl.com certificates

2013-10-09 Thread Dan Langille
On Oct 6, 2013, at 5:06 PM, Reindl Harald wrote: > > > Am 06.10.2013 22:42, schrieb Dan Langille: >> I have Thunderbird working just fine on my Macbook. >> >> But my goal is mail.app on my iPhone and my Macbook. When they try to >> connect, the mail server logs are: >> >> Oct 6 20:20:25 ima

Re: [Dovecot] SSL with startssl.com certificates

2013-10-08 Thread Dan Langille
On Oct 8, 2013, at 8:59 AM, Dan Langille wrote: > On 2013-10-07 13:57, Bruno Tréguier wrote: >> Le 06/10/2013 à 22:42, Dan Langille a écrit : >> After a long delay, I'm ready to tackle this again. >> [...] >> Testing via the command line gives: >> $ openssl s_client -connect imaps.unixathome.org:

Re: [Dovecot] SSL with startssl.com certificates

2013-10-08 Thread Dan Langille
On 2013-10-07 13:57, Bruno Tréguier wrote: Le 06/10/2013 à 22:42, Dan Langille a écrit : After a long delay, I'm ready to tackle this again. [...] Testing via the command line gives: $ openssl s_client -connect imaps.unixathome.org:993 CONNECTED(0003) depth=2 C = IL, O = StartCom Ltd., OU =

Re: [Dovecot] SSL with startssl.com certificates

2013-10-07 Thread Bruno Tréguier
Le 06/10/2013 à 22:42, Dan Langille a écrit : > After a long delay, I'm ready to tackle this again. [...] > Testing via the command line gives: > > $ openssl s_client -connect imaps.unixathome.org:993 > CONNECTED(0003) > depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Sign

Re: [Dovecot] SSL with startssl.com certificates

2013-10-07 Thread Dan Langille
On 2013-10-06 17:06, Reindl Harald wrote: Am 06.10.2013 22:42, schrieb Dan Langille: I have Thunderbird working just fine on my Macbook. But my goal is mail.app on my iPhone and my Macbook. When they try to connect, the mail server logs are: Oct 6 20:20:25 imaps dovecot: imap-login: Warning

Re: [Dovecot] SSL with startssl.com certificates

2013-10-06 Thread Reindl Harald
Am 06.10.2013 22:42, schrieb Dan Langille: > I have Thunderbird working just fine on my Macbook. > > But my goal is mail.app on my iPhone and my Macbook. When they try to > connect, the mail server logs are: > > Oct 6 20:20:25 imaps dovecot: imap-login: Warning: SSL failed: where=0x2002: >

Re: [Dovecot] SSL with startssl.com certificates

2013-10-06 Thread Dan Langille
On Sep 17, 2013, at 10:59 AM, Bruno Tréguier wrote: > Le 17/09/2013 à 16:32, Dan Langille a écrit : >> $ openssl s_client -connect imaps.unixathome.org:993 -quiet >> depth=0 >> /description=P4s7A2l6clvQRRJ4/C=US/CN=imaps.unixathome.org/emailAddress=postmas...@unixathome.org >> >> verify error:nu

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Noel Butler
On Tue, 2013-09-17 at 08:39 -0400, Dan Langille wrote: > > Since we just ruled this one out, might I suggest you grab the source > > and build it, install it all under /opt/dovecot that way it wont > > interfere with your ports installation and try that, the one you > > successfully just tested

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread LuKreme
On 16 Sep 2013, at 08:10 , Dan Langille wrote: > For this test, I reconfigured the server to NOT use IMAPS and restarted it. > Then I went > to my iPhone and turned off SSL for this mail account. > > That configuration works for my iPhone. This is very odd. For the record, I used an iPhone (i

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Reindl Harald
Am 17.09.2013 16:44, schrieb Dan Langille: > On 2013-09-17 10:39, Reindl Harald wrote: >> you are making it hard to impossible to help you if you are mixing servers >> and >> their responses and port 993 will *never ever* show STARTTLS because it is >> IMAPS which enforces a encrypted connection

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Bruno Tréguier
Le 17/09/2013 à 16:32, Dan Langille a écrit : > $ openssl s_client -connect imaps.unixathome.org:993 -quiet > depth=0 > /description=P4s7A2l6clvQRRJ4/C=US/CN=imaps.unixathome.org/emailAddress=postmas...@unixathome.org > > verify error:num=20:unable to get local issuer certificate > verify return:1

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Dan Langille
On 2013-09-17 10:39, Reindl Harald wrote: Am 17.09.2013 16:32, schrieb Dan Langille: *what* says "telnet your-server 143" $ telnet imaps.unixathome.org 143 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] Dovecot ready. At present, I am using dove

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Reindl Harald
Am 17.09.2013 16:32, schrieb Dan Langille: >> *what* says "telnet your-server 143" >> $ telnet imaps.unixathome.org 143 >> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE >> STARTTLS AUTH=PLAIN] Dovecot ready. > > At present, I am using dovecot-1.2.17 on another server

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Reindl Harald
Am 17.09.2013 15:57, schrieb Dan Langille: > On 2013-09-17 09:26, Reindl Harald wrote: >> Am 17.09.2013 15:01, schrieb Dan Langille: >> On 2013-09-17 08:43, Reindl Harald wrote: >> Am 17.09.2013 14:39, schrieb Dan Langille: >> On 2013-09-16 20:28, Noel Butler wrote: >> Since we just ruled this on

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Dan Langille
On 2013-09-17 10:05, Reindl Harald wrote: Am 17.09.2013 15:57, schrieb Dan Langille: On 2013-09-17 09:26, Reindl Harald wrote: Am 17.09.2013 15:01, schrieb Dan Langille: On 2013-09-17 08:43, Reindl Harald wrote: Am 17.09.2013 14:39, schrieb Dan Langille: On 2013-09-16 20:28, Noel Butler wrote: Si

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Dan Langille
On 2013-09-17 09:26, Reindl Harald wrote: Am 17.09.2013 15:01, schrieb Dan Langille: On 2013-09-17 08:43, Reindl Harald wrote: Am 17.09.2013 14:39, schrieb Dan Langille: On 2013-09-16 20:28, Noel Butler wrote: Since we just ruled this one out, might I suggest you grab the source and build it, ins

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Dan Langille
On 2013-09-17 09:08, Jerry wrote: On Tue, 17 Sep 2013 09:01:49 -0400 Dan Langille articulated: On 2013-09-17 08:43, Reindl Harald wrote: > Am 17.09.2013 14:39, schrieb Dan Langille: > On 2013-09-16 20:28, Noel Butler wrote: > Since we just ruled this one out, might I suggest you grab the > sourc

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Reindl Harald
Am 17.09.2013 15:01, schrieb Dan Langille: > On 2013-09-17 08:43, Reindl Harald wrote: >> Am 17.09.2013 14:39, schrieb Dan Langille: >> On 2013-09-16 20:28, Noel Butler wrote: >> Since we just ruled this one out, might I suggest you grab the source >> and build it, install it all under /opt/dovecot

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Jerry
On Tue, 17 Sep 2013 09:01:49 -0400 Dan Langille articulated: > On 2013-09-17 08:43, Reindl Harald wrote: > > Am 17.09.2013 14:39, schrieb Dan Langille: > > On 2013-09-16 20:28, Noel Butler wrote: > > Since we just ruled this one out, might I suggest you grab the > > source and build it, install it

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Dan Langille
On 2013-09-17 08:43, Reindl Harald wrote: Am 17.09.2013 14:39, schrieb Dan Langille: On 2013-09-16 20:28, Noel Butler wrote: Since we just ruled this one out, might I suggest you grab the source and build it, install it all under /opt/dovecot that way it wont interfere with your ports installati

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Reindl Harald
Am 17.09.2013 14:39, schrieb Dan Langille: > On 2013-09-16 20:28, Noel Butler wrote: >> Since we just ruled this one out, might I suggest you grab the source >> and build it, install it all under /opt/dovecot that way it wont >> interfere with your ports installation and try that, the one you >>

Re: [Dovecot] SSL with startssl.com certificates

2013-09-17 Thread Dan Langille
On 2013-09-16 20:28, Noel Butler wrote: On Mon, 2013-09-16 at 10:10 -0400, Dan Langille wrote: On Sep 14, 2013, at 10:36 PM, Noel Butler wrote: > On Sat, 2013-09-14 at 15:21 -0400, Dan Langille wrote: > > >>> >> >> Hmmm, I tried ssl = yes. Mail.app still crashes when trying to connect. >> > >

Re: [Dovecot] SSL with startssl.com certificates

2013-09-16 Thread Noel Butler
On Mon, 2013-09-16 at 10:10 -0400, Dan Langille wrote: > On Sep 14, 2013, at 10:36 PM, Noel Butler wrote: > > > On Sat, 2013-09-14 at 15:21 -0400, Dan Langille wrote: > > > > > >>> > >> > >> Hmmm, I tried ssl = yes. Mail.app still crashes when trying to connect. > >> > > > > > > Well, its

Re: [Dovecot] SSL with startssl.com certificates

2013-09-16 Thread Dan Langille
On Sep 16, 2013, at 10:56 AM, Reindl Harald wrote: > > > Am 16.09.2013 16:48, schrieb Dan Langille: >> On Sep 16, 2013, at 10:21 AM, Reindl Harald wrote: >> >>> Am 16.09.2013 16:10, schrieb Dan Langille: > Have you/they tried simply using TLS on 143? (preferred as POP3s/IMAPs > has re

Re: [Dovecot] SSL with startssl.com certificates

2013-09-16 Thread Reindl Harald
Am 16.09.2013 16:48, schrieb Dan Langille: > On Sep 16, 2013, at 10:21 AM, Reindl Harald wrote: > >> Am 16.09.2013 16:10, schrieb Dan Langille: Have you/they tried simply using TLS on 143? (preferred as POP3s/IMAPs has really be deprecated everywhere for some time now) >>> >>> For thi

Re: [Dovecot] SSL with startssl.com certificates

2013-09-16 Thread Dan Langille
On Sep 16, 2013, at 10:21 AM, Reindl Harald wrote: > > > Am 16.09.2013 16:10, schrieb Dan Langille: >>> Have you/they tried simply using TLS on 143? (preferred as POP3s/IMAPs >>> has really be deprecated everywhere for some time now) >> >> For this test, I reconfigured the server to NOT use I

Re: [Dovecot] SSL with startssl.com certificates

2013-09-16 Thread Reindl Harald
Am 16.09.2013 16:10, schrieb Dan Langille: >> Have you/they tried simply using TLS on 143? (preferred as POP3s/IMAPs >> has really be deprecated everywhere for some time now) > > For this test, I reconfigured the server to NOT use IMAPS and restarted it. > Then I went > to my iPhone and turn

Re: [Dovecot] SSL with startssl.com certificates

2013-09-16 Thread Dan Langille
On Sep 14, 2013, at 10:36 PM, Noel Butler wrote: > On Sat, 2013-09-14 at 15:21 -0400, Dan Langille wrote: > > >>> >> >> Hmmm, I tried ssl = yes. Mail.app still crashes when trying to connect. >> > > > Well, its likely an Apple fault, after all their implementation of pop3 > has been known

Re: [Dovecot] SSL with startssl.com certificates

2013-09-14 Thread Noel Butler
On Sat, 2013-09-14 at 15:21 -0400, Dan Langille wrote: > > > > Hmmm, I tried ssl = yes. Mail.app still crashes when trying to connect. > Well, its likely an Apple fault, after all their implementation of pop3 has been known to be broken for many many many years, but still after all these yea

Re: [Dovecot] SSL with startssl.com certificates

2013-09-14 Thread Dan Langille
On Sep 14, 2013, at 3:28 PM, Daniel Reinhardt wrote: > Are you getting asked to add an exception to the email applications > certificate dialogue box? > > This is an example with Thunderbird. > > http://jwrr.com/content/Hostgator-Thunderbird-Email-Configuration/images/thunderbird-mail-account-ad

Re: [Dovecot] SSL with startssl.com certificates

2013-09-14 Thread Daniel Reinhardt
Are you getting asked to add an exception to the email applications certificate dialogue box? This is an example with Thunderbird. http://jwrr.com/content/Hostgator-Thunderbird-Email-Configuration/images/thunderbird-mail-account-add-security-exception.jpg Dan On Sat, Sep 14, 2013 at 7:21 PM, D

Re: [Dovecot] SSL with startssl.com certificates

2013-09-14 Thread Dan Langille
On Sep 13, 2013, at 9:55 PM, Noel Butler wrote: > On Fri, 2013-09-13 at 10:18 -0400, Dan Langille wrote: > > >> Perhaps I am doing the chain incorrectly. I just tried again. The >> server is now set up with the following: >> >> I have three certs in this chain file: >> >> cat imaps.unixath

Re: [Dovecot] SSL with startssl.com certificates

2013-09-13 Thread Noel Butler
On Fri, 2013-09-13 at 10:18 -0400, Dan Langille wrote: > Perhaps I am doing the chain incorrectly. I just tried again. The > server is now set up with the following: > > I have three certs in this chain file: > > cat imaps.unixathome.org.pem sub.class1.server.ca.pem ca.pem > > testing.chain

Re: [Dovecot] SSL with startssl.com certificates

2013-09-13 Thread Johan Huldtgren
I'm using Dovecot 2.2.5. I'm setting up and new IMAPS server for personal use (i.e. only me). I have success with self-signed certificates but not with others (e.g. my setup is similar (although I'm at dovecot 2.1.17) using certs from StartSSL with several macs and many iphones, and it works.

Re: [Dovecot] SSL with startssl.com certificates

2013-09-13 Thread Dan Langille
On 2013-09-13 10:18, Dan Langille wrote: On 2013-09-13 09:18, Oscar del Rio wrote: On 09/13/13 07:59 AM, Dan Langille wrote: I'm using Dovecot 2.2.5. I'm setting up and new IMAPS server for personal use (i.e. only me). I have success with self-signed certificates but not with others (e.g. St

Re: [Dovecot] SSL with startssl.com certificates

2013-09-13 Thread Dan Langille
On 2013-09-13 09:18, Oscar del Rio wrote: On 09/13/13 07:59 AM, Dan Langille wrote: I'm using Dovecot 2.2.5. I'm setting up and new IMAPS server for personal use (i.e. only me). I have success with self-signed certificates but not with others (e.g. StartSSL.com) /usr/local/etc/ssl/imaps.un

Re: [Dovecot] SSL with startssl.com certificates

2013-09-13 Thread Oscar del Rio
On 09/13/13 07:59 AM, Dan Langille wrote: I'm using Dovecot 2.2.5. I'm setting up and new IMAPS server for personal use (i.e. only me). I have success with self-signed certificates but not with others (e.g. StartSSL.com) /usr/local/etc/ssl/imaps.unixathome.org.crt contains only the cert is

[Dovecot] SSL with startssl.com certificates

2013-09-13 Thread Dan Langille
I'm using Dovecot 2.2.5. I'm setting up and new IMAPS server for personal use (i.e. only me). I have success with self-signed certificates but not with others (e.g. StartSSL.com) With StartSSL certs: I've been able to connect and test commands via: openssl s_client -connect imaps.unixathom