Thunderbird fails to connect to Dovecot and Postfix

Question

I set up Dovecot and Postfix, but when I try to authenticate with Thunderbird, it gives this error: "Thunderbird failed to find the settings for your email account."

==> /var/log/dovecot-info.log <==
Apr 06 10:42:16 auth: Debug: auth client connected (pid=13243)
Apr 06 10:42:16 imap-login: Info: Disconnected (no auth attempts): rip=76.xx.xx.xx, lip=172.31.15.65, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42

==> /var/log/maillog <==
Apr  6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: lost connection after UNKNOWN from user-xxxxxx.cable.mindspring.com[76.xx.xx.xxx]
Apr  6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: disconnect from user-xxxxxx.cable.mindspring.com[76.xx.xx.xx]

I can connect with telnet.

Here is the Thunderbird error.

Answer 1

I had similar problems with Thunderbird on Mac OSX and a new StartSSL cert. Thunderbird uses OCSP to validate the certificates and fails silently in this special case. Additionally the StartSSL OCSP server need some time to update the catalogue of known certificates (compare with https://forum.startcom.org/viewtopic.php?t=2654).

To check if OCSP is the cause of the trouble disable it temporarily and retry to connect to your server.

Preferences -> Advanced -> Certificates -> Validation -> Uncheck "Use the Online Certificate Status Protocol (OCSP) to confirm the current validity of certificates"

Answer 2

It's not a bug of Thunderbird.

Check that /etc/dovecot/dovecot.pem refers to the right SSL certificate you bought

Also update the CA authority in /etc/dovecot/dovecot.ca.pem

Then restart dovecot:

service dovecot restart

Answer 3

Just a note - RFC 8314 - which is AFTER the answer by @gogoud - has once again standardized Port 465 for submission with implicit TLS using SMTPS and had deprecated submission via Port 587 as obsolete.

RFC 8314 also requires TLS 1.2 or better for connecting to a Mail Service Agent.

Answer 4

There MUST be a bug in Thunderbird. Even though I imported the server's certificate and added an exception, and it validates with openssl client, Thunderbird still fails. I was able to get it to work by using non-encrypted port numbers, but at least it uses STARTTLS to enable encryption anyways. I must star this to remember it a year from now.

$ openssl s_client -connect olixxxxx.xxx:993
CONNECTED(00000003)
... lots of certificate info ...
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready.
. login staxxxxxx xxxxxxxxpasswordxxxxxxxxxxxx
. OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in
. logout
* BYE Logging out

Answer 5

This drove me mad!!!

In my case an existing setup stopped working when I've updated the outgoing and incoming server domain addresses, everything else stayed the same yet I was not connecting and getting ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 in the logs.

There must be some bug in Thunderbird...as the solutios was to delete the Thunderbird account and re-create it.

To help you save some time I've also tried the below with no succeess:

• Thunderbird advanced settings from here: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921/6
• triple checked my dovecot.conf SSL setup

Again like in my case, if all else fails try just deleting and re-creating the accounts.

Answer 6

On Thunderbird, security.tls.version.min is 3 by default. If is an old postfix / dovecot, you have to set security.tls.version.min to 1 or to upgrade postfix , dovecot.

Answer 7

There is still that bug in thunderbird (68.10.0, Ubuntu). Suddenly I had this problem connecting dovecot (TLS handshaking: SSL_ac cept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certi ficate: SSL alert number 42).

Deleting the .thunderbird directory and doing a new setup solved it:

dovecot: imap-login: Login: user=<michael>, method=PLAIN, rip=92.74.149.129, lip=81.169.234.123, mpid=2880, TLS

Answer 8

In case someone lands here and your certificate is issued with OCSP must staple you have to disable that feature in Thunderbird because Dovecot (and Postfix) probably never will support it.

Go to the Thunderbird Settings - General - scroll to the Bottom and click "Config Editor..." - accept the risk and search for the following value: security.ssl.enable_ocsp_must_staple and set it to False (by double clicking it).

Answer 9

I had a similar problem with Thunderbird and Dovecot after changing old certificate to new.

When I try connect to the Dovecot, I couldn't accept the new certificate on Thunderbird v 78.7.1 (32 bits) and I was a message in the dovecot log:

TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42

I solved the problem without deleting email acount on Thunderbird as follows:

• in the problematic email acount in incoming mail server settings I temporarily changed the address of the mail server,
• I created a new account with correct incoming mails server adress,
• when receiving emails I accepted wtih no problem the certificate,
• I deleted the new account.
• and I restored the correct address of the incoming mail server in the original account.

Answer 10

For postfix to work with Thunderbird's 'SSL/TLS' setting for port 465, use master.cf settings like this:

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes

(The 'y' in the first line is if postfix runs chrooted, otherwise it should be 'n')

This is a deprecated way to connect - it's more normal these days to use STARTTLS over port 587 ('submission').

Answer 11

I had the same problem with Thunderbird and dovecot but a little different scenario. I set up a new VM instance with Zentyal to switch form 4.2. to 6.2. I configured the new 6.2 instance the same 4.2 was (everything was the same, hostname, users, mail addresses, except the certificates). When Thunderbird tried to authenticate it showed me the message that the cert has changed. I added an exception for the new cert but Thunderbird wasn't able to connect. Every time the message with the change certificate appeared.The strange thing was that the hostname didn't match the name whether the new nor old Zentyal instance. For some reason, Thunderbird got the hostname of the VM host.

In the end I resolved the problem by changing the configuration via about:config. In the about:config I searched for entries with hostname and changed the incorrect value to the Zentyal hostname.