I have configured dovecot to use Client certificate authentication. I have used CA.pl (openssl wrapper) to create CA cert and sign client and server certs with that.(no certificate chain, CA cert is trusted in client) I have set the certificate as CA certificate in dovecot for client auth. Dovecot correctly asks IceDove for certificates but after clicking OK, It fails with error "Client didn't present valid SSL certificate."

Using openssl to manually test IMAP connection also results in this error.

dovecot config: https://gist.github.com/Xcess/71f7eeeda0a270b252f1de5d7308c0e2

I have tried certificate with CN=user1 and [email protected]. both failed. Also set common-name to be username in dovecot conf...no difference.

I don't know what to do as this is all stated in manuals and seems pretty simple and straightforward. But it fails.


Update 1: output of command openssl x509 -in certificate.crt -text -noout:

Certificate: Data: Version: 3 (0x2) Serial Number: 8e:3d:9b:7c:13:35:88:b7
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IR, ST=Isf, O=Apps4you, CN=lnxsrv2
Not Before: Mar 1 10:45:32 2017 GMT
Not After : Mar 1 10:45:32 2018 GMT
Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=user1/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
--- Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: CA:FALSE
Netscape Comment: OpenSSL Generated Certificate
X509v3 Subject Key Identifier: ---
-----Output ommited-----

Update 2: this slightly modified config file also doesn't work: https://gist.github.com/Xcess/599beaec17a4a524a2acbde1b7f5c70f

Update 3:
Verbose SSL Log file :

  • X.509 can be a complicated theme for someone not familiar with it. For starters, nowadays most of the modern OS/browsers are starting to refuse certificates with a key smaller than 2048 bits. see unix.stackexchange.com/questions/331979/webmin-stopped-opening Commented Mar 1, 2017 at 11:46
  • I advise you to add the output of openssl x509 -in certificate.crt -text -noout to the post. Edit the relevant bits to take out private information. Commented Mar 1, 2017 at 11:57
  • 1
    @RuiFRibeiro I added the output. Thanks. btw, this is a server error and client is not rejecting anything.
    – Shahriar
    Commented Mar 1, 2017 at 12:43
  • I assume that is the client certificate. I am not seeing any X.509 extensions/ OIDs about being a certificate used for client authentication, hence the error... do you have any? Commented Mar 1, 2017 at 13:03

2 Answers 2


You need to add a X.509 Extension to this cert to use it for client authentication.

In openssl.cnf, under [ usr_cert ], per the openssl.conf example:

[ usr_cert ]
nsCertType = client, email

However, supposedly the nsCertType is obsolete, and it is required to also add a X.509 extension. Add then a new section:

[ xpclient_ext]
extendedKeyUsage =

To add the extension, you will also need to pass the option -extensions xpclient_ext to openssl when generating the certificate.

The following extended key usage purposes are defined by RFC 3280:

serverAuth ( -- TLS Web server authentication
clientAuth ( -- TLS Web client authentication

Please do note that I advise to both add the nsCertType and the RFC 3280 extension. Some software, notably PfSense, still check for nsCertType.

  • Thanks for your answer, sorry for replying late. I'm going to test it today and report back the result. However I should say that the same certificate worked fine for NginX client certificate authentication.
    – Shahriar
    Commented Mar 3, 2017 at 7:14
  • I set both options you said, and created a keypair with openssl command. the I signed it with CA.pl like usual. then converted to pkcs12 then imported into system and icedove. Still same error :(
    – Shahriar
    Commented Mar 3, 2017 at 7:56
  • what errors have you in the log files? Commented Mar 3, 2017 at 9:47
  • Please also add to the question the cert on the server side. Commented Mar 3, 2017 at 9:52
  • log added @rui-f-ribeiro . you mean the CA or server cert? both are working fine by themselves. before client certificate everything was ok and also CA works fine.
    – Shahriar
    Commented Mar 3, 2017 at 11:56

I found the answer so I thought I should post it here too. (precisely @behrad-eslamifar did :)

you should append the CRL to the CA certificate given to dovecot EVEN IF YOU HAVE SET ssl_require_crl = no

like this way :

openssl ca -gencrl -out crlfile
cat crlfile >> cacert.pem
service dovecot restart

thanks everyone for their suggestions. <3

  • Together with the bits about being client, no? Pretty interesting nonetheless, it may be worth filing a bug with the dovecot guys. Commented Mar 3, 2017 at 15:46
  • cert type etc you mean? yes I changed those with no result. I've tried everything... :/ I agree It's worth filling a bug. Do so if you can please...
    – Shahriar
    Commented Mar 3, 2017 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .