Re: Problems connecting to imap after upgrade of openssl to v3

Sam Varshavchik <[email protected]> Wed, 18 Oct 2023 09:34:33 -0400

Newsgroups	gmane.mail.imap.courier.general
Message-ID	<[email protected]>

Kristian Duus Østergaard writes:

> Thanks Sam,
>
> After reenabling the legacy and weak algorithms IPv4 will connect.
>
> But as my server is dual-stack and prefers IPv6 i get a new error.
>
> When I run the following command :
> # openssl s_client --connect mail.kristian-duus.dk:143 -starttls imap
>>
>> removed long listing with the found certificates
>>
> ---
> read R BLOCK
> 40B73AAA527F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version  
> number:../openssl-3.0.11/ssl/record/ssl3_record.c:358:

In the past this is caused generally by one of three reasons.

1) Non-default TLS settings in the imapd-ssl, pop3d-ssl, or esmtpd-ssl  
configuration file. Specifically TLS_PROTOCOL, TLS_CIPHER_LIST, and  
TLS_STARTTLS protocol. If there's something set for them, remove the  
settings and restart.

2) Even though the legacy support is now enabled, there's still something in  
the certificate that causes OpenSSL to keel over.

3) You're testing OpenSSL from a different machine it might be necessary to  
enable legacy support on it, too.

However you indicate that only IPv6 appears to have an issue. There's  
nothing in Courier regarding IPv4 of IPv6 when it comes to using OpenSSL. It  
takes care of setting up the socket and hands it over to OpenSSL.

The only thing in Courier that's in any way related is certificate file  
lookups. Different certificates can be set up, ${TLS_CERTFILE}.domain1, and $ 
{TLS_CERTFILE}.domain2. IP addresses can also be used here; however I would  
think you'd mention this exotic configuration, were it to be the case with  
you.

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

signature.asc (application/pgp-signature, 228 B)