I set up Dovecot and Postfix, but when I try to authenticate with Thunderbird, it gives this error: "Thunderbird failed to find the settings for your email account."

==> /var/log/dovecot-info.log <==
Apr 06 10:42:16 auth: Debug: auth client connected (pid=13243)
Apr 06 10:42:16 imap-login: Info: Disconnected (no auth attempts): rip=76.xx.xx.xx, lip=, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42

==> /var/log/maillog <==
Apr  6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: lost connection after UNKNOWN from user-xxxxxx.cable.mindspring.com[76.xx.xx.xxx]
Apr  6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: disconnect from user-xxxxxx.cable.mindspring.com[76.xx.xx.xx]

I can connect with telnet.

Here is the Thunderbird error.


14 Answers 14


I had similar problems with Thunderbird on Mac OSX and a new StartSSL cert. Thunderbird uses OCSP to validate the certificates and fails silently in this special case. Additionally the StartSSL OCSP server need some time to update the catalogue of known certificates (compare with https://forum.startcom.org/viewtopic.php?t=2654).

To check if OCSP is the cause of the trouble disable it temporarily and retry to connect to your server.

Preferences -> Advanced -> Certificates -> Validation -> Uncheck "Use the Online Certificate Status Protocol (OCSP) to confirm the current validity of certificates"

  • 4
    If OCSP Must-Staple is set on the certificate, you can't disable it. Postfix and Dovecot don't support OCSP stapling (as of this comment), so Thunderbird will refuse to connect to them. Reissuing my certificates without the requirement solved the issue.
    – Techwolf
    Apr 28, 2017 at 4:29

I had a similar problem with Thunderbird and Dovecot after changing old certificate to new.

When I try connect to the Dovecot, I couldn't accept the new certificate on Thunderbird v 78.7.1 (32 bits) and I was a message in the dovecot log:

TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42

I solved the problem without deleting email acount on Thunderbird as follows:

  • in the problematic email acount in incoming mail server settings I temporarily changed the address of the mail server,
  • I created a new account with correct incoming mails server adress,
  • when receiving emails I accepted wtih no problem the certificate,
  • I deleted the new account.
  • and I restored the correct address of the incoming mail server in the original account.

It's not a bug of Thunderbird.

Check that /etc/dovecot/dovecot.pem refers to the right SSL certificate you bought

Also update the CA authority in /etc/dovecot/dovecot.ca.pem

Then restart dovecot:

service dovecot restart

Just a note - RFC 8314 - which is AFTER the answer by @gogoud - has once again standardized Port 465 for submission with implicit TLS using SMTPS and had deprecated submission via Port 587 as obsolete.

RFC 8314 also requires TLS 1.2 or better for connecting to a Mail Service Agent.


In case someone lands here and your certificate is issued with OCSP must staple you have to disable that feature in Thunderbird because Dovecot (and Postfix) probably never will support it.

Go to the Thunderbird Settings - General - scroll to the Bottom and click "Config Editor..." - accept the risk and search for the following value: security.ssl.enable_ocsp_must_staple and set it to False (by double clicking it).


There MUST be a bug in Thunderbird. Even though I imported the server's certificate and added an exception, and it validates with openssl client, Thunderbird still fails. I was able to get it to work by using non-encrypted port numbers, but at least it uses STARTTLS to enable encryption anyways. I must star this to remember it a year from now.


$ openssl s_client -connect olixxxxx.xxx:993
... lots of certificate info ...
. login staxxxxxx xxxxxxxxpasswordxxxxxxxxxxxx
. logout
* BYE Logging out

This drove me mad!!!

In my case an existing setup stopped working when I've updated the outgoing and incoming server domain addresses, everything else stayed the same yet I was not connecting and getting ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 in the logs.

There must be some bug in Thunderbird...as the solutios was to delete the Thunderbird account and re-create it.

To help you save some time I've also tried the below with no succeess:

Again like in my case, if all else fails try just deleting and re-creating the accounts.


On Thunderbird, security.tls.version.min is 3 by default. If is an old postfix / dovecot, you have to set security.tls.version.min to 1 or to upgrade postfix , dovecot.


There is still that bug in thunderbird (68.10.0, Ubuntu). Suddenly I had this problem connecting dovecot (TLS handshaking: SSL_ac cept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certi ficate: SSL alert number 42).

Deleting the .thunderbird directory and doing a new setup solved it:

dovecot: imap-login: Login: user=<michael>, method=PLAIN, rip=, lip=, mpid=2880, TLS

  • It works. Rename it in order to recover something after Nov 13, 2020 at 20:16

I can see in wireshark that thunderbird is sending back the 42 ALERT - 42 means bad certificate.

I found a workaround by manually adding the server certificate to the list of exceptions.

I wrote more about it here..


I encountered the problem again. And this time I setup a socat instead of a webserver to trick thunderbird into creating a server certificate exception

  1. on the command line issue

sudo socat tcp-l:443,fork,reuseaddr tcp:mail.myserver.biz:993

  1. Edit->Settings->Privacy & Security->Certificates-Manage Certificates->Servers->Add Exception

Location = https://localhost

  • Press Get Certificate
  • Select Permanently store this exception
  • Press Confirm Security Exception
  1. Next edit the cert_override.txt file and update the server FQDN.

gvim $(find ~/.thunderbird/ -name cert_override.txt)

edit the line starting with localhost:443: change it to mail.myserver.biz:993:

Be sure not to damage the file, preserving the tabs and : colon after the port number.

Basically it seems the Add Exception dialog box cannot connect directly to imaps:sever:993 to download the tls server certificate. I think this is a defect in the Thunderbird.

The socat step is a workaround to trick Thunderbird to download the certificate.

You can also use the command to see the fingerprints of the server certificate (and the ca certificate) to verify the fingerprint matches in the cert_override.txt file

openssl s_client -connect mail.myserver.biz:443 -CAfile cacert.pem -showcerts | while openssl x509 -noout -oid -sha256 -fingerprint -text; do :; done

I hope this helps saves someone some time.


For postfix to work with Thunderbird's 'SSL/TLS' setting for port 465, use master.cf settings like this:

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes

(The 'y' in the first line is if postfix runs chrooted, otherwise it should be 'n')

This is a deprecated way to connect - it's more normal these days to use STARTTLS over port 587 ('submission').


I had the same problem with Thunderbird and dovecot but a little different scenario. I set up a new VM instance with Zentyal to switch form 4.2. to 6.2. I configured the new 6.2 instance the same 4.2 was (everything was the same, hostname, users, mail addresses, except the certificates). When Thunderbird tried to authenticate it showed me the message that the cert has changed. I added an exception for the new cert but Thunderbird wasn't able to connect. Every time the message with the change certificate appeared.The strange thing was that the hostname didn't match the name whether the new nor old Zentyal instance. For some reason, Thunderbird got the hostname of the VM host.

In the end I resolved the problem by changing the configuration via about:config. In the about:config I searched for entries with hostname and changed the incorrect value to the Zentyal hostname.


Same problem with a self-signed certificate - solved

Whereas claws-mail or evolution allowed me to accept the self-signed certificate from my local Dovecot IMAP server, Thunderbird failed silently. My solution was to use the same certificate in a web server (nginx) on that local server running Dovecot. Then in Thunderbird I went to Preferences / Security / Certificates / Manage Certificates... / Servers / Add exception... and having added the certificate there, Thunderbird was able to connect as well. :)

(I'm using this local IMAP server to store e-mail from different IMAP accounts, which I'm accessing from different computers. I only sort messages this way when I'm at home, so maybe I would not even need SSL - but using encryption for e-mail just feels better).


I had a similar problem. I have a postfix/dovecot server and connect using thunderbird on windows 10. Thunderbird updated and restarted today, then I started getting the error:

Sep 10 08:56:57 myserver dovecot[86494]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 0 secs): user=<>, rip=x.x.x.x, lip=y.y.y.y, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<2EqIdkboHtZqRVPG>

I was working through a solution above, to create a new account, but noticed when I renamed my old account and setup the username and password again, it started working. I have two accounts I connect to, one stopped working and the other didn't. Once I reconfigured the problem email account, it started working. I renamed it back to the original name and it is still working. I also turned off OSCP, but that didn't seem to work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .