Re: Log: Certificate is bad

[email protected] writes:

> Hardlink with the IP appended to the same file. I tried with the original  
> auto generated pem and with one from letsencrypt like I used to do in the  
> old setting. Whenever I try to connect tls via port 993 a log line appears  
> "Certificate is bad". I am pretty sure imapd does not even look at the file:  
> stat shows no update on atime.
> What do I miss?

"Certificate is bad" is the GNUTLS_A_BAD_CERTIFICATE TLS error that's  
getting reported by GnuTLS. imapd does not validate certificates, unless  
client certificate are used, which you would've mentioned. It's the client  
that rejects the certificate, for whatever reason.

Typical reason why a certificate gets rejected include wrong canonical name,  
or if there's an intermediate certificate signing authority that the client  
does not trust. If you need to use an intermediate cert it must be  
concatenated with your certificate in the same .pem file, in a specific  
order. I never remember whether the intermediate cert goes first, or last.

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQRupkKLJP96aW75pIOKYPgoojZS4gUCZUF3tgAKCRCKYPgoojZS
4pk2AP9D3NBRZZdokqodiLdXQWFCPP6uhBJoalDrZWAD6rx0JwEAks3K2TzxSygJ
FisNYESLf/2sRx96Y8tLhvFlo4H3wgA=
=EYSK
-----END PGP SIGNATURE-----