雷鸟没有连接到后缀/Dovecot。网络邮件作品

Question

雷鸟没有连接到后缀/Dovecot。

我的webmail界面使用登录(name@domain.tld +密码)，

传入(SSL/TLS，端口993)和传出消息(STARTTLS，端口587)。

我做了一些调试，并知道这一定是一个证书错误。

请问这里有人知道怎么修吗？

这是我的带有SSL调试的mail.log：

Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: unknown state [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [x.x.x.x]
Apr 26 16:57:28 m123851 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [x.x.x.x]
Apr 26 16:57:29 m123851 dovecot: imap-login: Warning: SSL alert: where=0x4004, ret=560: fatal unknown CA [x.x.x.x]
Apr 26 16:57:29 m123851 dovecot: imap-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [x.x.x.x]
Apr 26 16:57:29 m123851 dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=192.x.x.x, lip=85.x.x.x, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48, session=<NDYo2aEUWQAfBhbN>

这是我的文件(/etc/ Dovecot /con.d/10-ssl.conf)：

# Log SSL problems
verbose_ssl = yes

ssl = required

ssl_cert = </etc/dovecot/dovecot.pem
ssl_key = </etc/dovecot/private/dovecot.pem

ssl_protocols = !SSLv3 !SSLv2

ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+
                  SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+
                  CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:
                  !EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:
                  AES256-SHA:CAMELLIA128-SHA:AES128-SHA

ssl_prefer_server_ciphers = yes

Dovecot的SSL证书是为本地主机设置的。

当我试图将根ca和域证书集成到dovecot证书中时，问题仍然存在：

dovecot.pem cert =dovecot.pem内容+域cert内容+根ca cert内容(完全按自上而下的顺序排列)

dovecot.pem key =dovecot.pem+ domain + root (完全按自上而下的顺序排列)

Answer 1

雷鸟期望dovecot为其提供验证连接所需的证书(中介证书或自签名CA证书)。查看http://wiki2.dovecot.org/SSL/DovecotConfiguration中的“链接SSL证书”。

您可以通过将中间证书添加到SSL文件(/etc/ssl/certs/imap.pem或ssl_cert所指向的任何位置)来修复此问题。如果您从供应商那里获得SSL证书，他们应该有关于如何获得中介证书的说明。