This is for those who already have working Lets Encrypt SSL certs working on their websites, and already have self-signed SSL certs working with a dovecot/postfix setup.
All you should have to do is edit your 10-ssl.conf files (mine is in /etc/dovecot/conf.d/10-ssl.conf) to point to your Lets Encrypt SSL files.
This way thunderbird can request the correct certificate, and this allows user to connect / configure accounts using imap.domain1.td or imap.domain2.td depending on the email address without receiving cert errors.
Since this is one of the top results of a “dovecot letsencrypt” search, perhaps it should be added that the default config - at least the one shipped by Ubuntu - does not seem to be save against recent SSL attacks. In my Config, only SSL2 is disabled, not SSL3.
From my Apache2 config that tests safe at Qualys, I derived these two lines:
What si the reason to define ssl_ca?. Are you authenticating your users via certificates?. If you are not, remove/comment out ssl_ca directives, restart Dovecot and try again. Indeed, if you are using it, you should have somewhere in your config the directive ssl_verify_client_cert=yes, and as I said, if you have it defined to no (it is the default) you should not use ssl_ca directive.
If that doesn't work, try this config for the following directives:
# SSL protocols to use
ssl_protocols = !SSLv2 !SSLv3
# SSL ciphers to use
ssl_cipher_list = HIGH:!SSLv2:!aNULL@STRENGTH
# Prefer the server's order of ciphers over client's.
ssl_prefer_server_ciphers = yes
Restart Dovecot and try again.
Of course, before changing anything, always backup your conf just in case.
Ok guys. Thanks to your guide, I was able to get my email to work perfectly on my android phone app, however, nothing that I’ve tried in this thread has worked for Thunderbird. I tried the config that @RuGa suggested & the config that @sahsanu suggested & nothing is working for Thunderbird (52.1.1).
I’ve turned on debugging & get this message in my syslog: dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=**************, lip=**************
Does anyone have any suggestions on how to troubleshoot this?
@diamonds, I did some very preliminary tests and I think there might be some kind of difference between what your server does with IMAP STARTTLS (on port 143) and IMAPS (on port 993). Your server is offering both, and I think I did see different error messages in these two cases.
In Thunderbird, if you do an automated account setup, it apparently prefers IMAP STARTTLS (which seems like an incredibly bad default to me) over IMAPS. Could you try again with a manual account setup indicating that you specifically want to use IMAPS on port 993 instead of the default?
@schoen I’ve tried every manual setting configuration that Thunderbird offers for to log in. I’ve used the username with both, just user, & with the email address.
I’m having the same problem that @RuGa was having (I can log in with my phone via SSL perfectly fine)…so, it’s a Thunderbird setting issue, but I don’t know which one or how to troubleshoot it.
The manual config to setup a mailbox offers very limited options & the “Advance config” is greyed out. I don’t know how to troubleshoot this & there is very little information on the Internet about this problem.
I even asked on Dovecot’s mailing list & go nowhere with a solution. Any other suggestions?
this ssl serts working in nginx, but fails in dovecot
mail:~# dpkg -l |grep dovecot
ii dovecot-core 1:2.2.27-3~bpo8+1 amd64 secure POP3/IMAP server - core files
ii dovecot-imapd 1:2.2.27-3~bpo8+1 amd64 secure POP3/IMAP server - IMAP daemon
ii dovecot-mysql 1:2.2.27-3~bpo8+1 amd64 secure POP3/IMAP server - MySQL support
Do you literally have the less-than character < in your configuration file where you specify the certificate and private key? Is that part of the configuration file syntax?