Re: [Dovecot] require SSL certs only for encrypted connections?

2009-09-28 Thread Timo Sirainen
On Tue, 2009-09-22 at 10:02 -0700, Florin Andrei wrote: > > ssl_require_client_cert = yes > > remote_ip 192.168.0.0/16 { > > ssl_require_client_cert = no > > } > > > > That's almost possible in v2.0. > > "Almost"? :-) Well, the problem is that this setting is checked by both auth process and l

Re: [Dovecot] require SSL certs only for encrypted connections?

2009-09-22 Thread Florin Andrei
Timo Sirainen wrote: On Thu, 2009-08-27 at 14:30 -0700, Florin Andrei wrote: Timo Sirainen wrote: Hmm. Maybe the setting could have a new "with-ssl" option or something.. That would be awesome. If I'm not mistaken, it's a pretty common situation to use certs on SSL but not require them on non-

Re: [Dovecot] require SSL certs only for encrypted connections?

2009-08-27 Thread Florin Andrei
Timo Sirainen wrote: On Thu, 2009-08-20 at 18:30 -0700, Florin Andrei wrote: # 1.1.11: /etc/dovecot/dovecot.conf .. Is there a way to require a cert from the iPhone TLS connections on port 993, but do not require it from clients connecting to port 143? Not that easily.. A few possibilities:

Re: [Dovecot] require SSL certs only for encrypted connections?

2009-08-27 Thread Timo Sirainen
On Thu, 2009-08-27 at 14:30 -0700, Florin Andrei wrote: > Timo Sirainen wrote: > > > > Hmm. Maybe the setting could have a new "with-ssl" option or something.. > > That would be awesome. If I'm not mistaken, it's a pretty common > situation to use certs on SSL but not require them on non-SSL. Ki

Re: [Dovecot] require SSL certs only for encrypted connections?

2009-08-27 Thread Florin Andrei
Timo Sirainen wrote: Hmm. Maybe the setting could have a new "with-ssl" option or something.. That would be awesome. If I'm not mistaken, it's a pretty common situation to use certs on SSL but not require them on non-SSL. Kind of makes sense to me at least. Any chance to add something like

Re: [Dovecot] require SSL certs only for encrypted connections?

2009-08-24 Thread Timo Sirainen
On Thu, 2009-08-20 at 18:30 -0700, Florin Andrei wrote: > # 1.1.11: /etc/dovecot/dovecot.conf .. > Is there a way to require a cert from the iPhone TLS connections on port > 993, but do not require it from clients connecting to port 143? Not that easily.. A few possibilities: a) Run two differen

[Dovecot] require SSL certs only for encrypted connections?

2009-08-20 Thread Florin Andrei
# 1.1.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.28-14-server x86_64 Ubuntu 9.04 Here's the situation: I have several local clients (Thunderbird) which do not use TLS at all. It's plaintext completely, on port 143, because the connection is local and there are no unauthorized users on this n