4

I set up Dovecot and Postfix, but when I try to authenticate with Thunderbird, it gives this error: "Thunderbird failed to find the settings for your email account."

==> /var/log/dovecot-info.log <==
Apr 06 10:42:16 auth: Debug: auth client connected (pid=13243)
Apr 06 10:42:16 imap-login: Info: Disconnected (no auth attempts): rip=76.xx.xx.xx, lip=172.31.15.65, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42

==> /var/log/maillog <==
Apr  6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: lost connection after UNKNOWN from user-xxxxxx.cable.mindspring.com[76.xx.xx.xxx]
Apr  6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: disconnect from user-xxxxxx.cable.mindspring.com[76.xx.xx.xx]

I can connect with telnet.

Here is the Thunderbird error.

Imgur

6

I had similar problems with Thunderbird on Mac OSX and a new StartSSL cert. Thunderbird uses OCSP to validate the certificates and fails silently in this special case. Additionally the StartSSL OCSP server need some time to update the catalogue of known certificates (compare with https://forum.startcom.org/viewtopic.php?t=2654).

To check if OCSP is the cause of the trouble disable it temporarily and retry to connect to your server.

Preferences -> Advanced -> Certificates -> Validation -> Uncheck "Use the Online Certificate Status Protocol (OCSP) to confirm the current validity of certificates"

  • 2
    If OCSP Must-Staple is set on the certificate, you can't disable it. Postfix and Dovecot don't support OCSP stapling (as of this comment), so Thunderbird will refuse to connect to them. Reissuing my certificates without the requirement solved the issue. – Techwolf Apr 28 '17 at 4:29
1

There MUST be a bug in Thunderbird. Even though I imported the server's certificate and added an exception, and it validates with openssl client, Thunderbird still fails. I was able to get it to work by using non-encrypted port numbers, but at least it uses STARTTLS to enable encryption anyways. I must star this to remember it a year from now.

Imgur

$ openssl s_client -connect olixxxxx.xxx:993
CONNECTED(00000003)
... lots of certificate info ...
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready.
. login staxxxxxx xxxxxxxxpasswordxxxxxxxxxxxx
. OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in
. logout
* BYE Logging out
0

It's not a bug of Thunderbird.

Check that /etc/dovecot/dovecot.pem refers to the right SSL certificate you bought

Also update the CA authority in /etc/dovecot/dovecot.ca.pem

Then restart dovecot:

service dovecot restart
0

For postfix to work with Thunderbird's 'SSL/TLS' setting for port 465, use master.cf settings like this:

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes

(The 'y' in the first line is if postfix runs chrooted, otherwise it should be 'n')

This is a deprecated way to connect - it's more normal these days to use STARTTLS over port 587 ('submission').

0

Just a note - RFC 8314 - which is AFTER the answer by @gogoud - has once again standardized Port 465 for submission with implicit TLS using SMTPS and had deprecated submission via Port 587 as obsolete.

RFC 8314 also requires TLS 1.2 or better for connecting to a Mail Service Agent.

0

This drove me mad!!!

In my case an existing setup stopped working when I've updated the outgoing and incoming server domain addresses, everything else stayed the same yet I was not connecting and getting ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 in the logs.

There must be some bug in Thunderbird...as the solutios was to delete the Thunderbird account and re-create it.

To help you save some time I've also tried the below with no succeess:

Again like in my case, if all else fails try just deleting and re-creating the accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.