I have configured dovecot to use Client certificate authentication. I have used CA.pl (openssl wrapper) to create CA cert and sign client and server certs with that.(no certificate chain, CA cert is trusted in client) I have set the certificate as CA certificate in dovecot for client auth. Dovecot correctly asks IceDove for certificates but after clicking OK, It fails with error "Client didn't present valid SSL certificate."

Using openssl to manually test IMAP connection also results in this error.

dovecot config: https://gist.github.com/Xcess/71f7eeeda0a270b252f1de5d7308c0e2

I have tried certificate with CN=user1 and CN=user1@domain.com. both failed. Also set common-name to be username in dovecot conf...no difference.

I don't know what to do as this is all stated in manuals and seems pretty simple and straightforward. But it fails.


Update 1: output of command openssl x509 -in certificate.crt -text -noout:

Certificate: Data: Version: 3 (0x2) Serial Number: 8e:3d:9b:7c:13:35:88:b7
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IR, ST=Isf, O=Apps4you, CN=lnxsrv2
Not Before: Mar 1 10:45:32 2017 GMT
Not After : Mar 1 10:45:32 2018 GMT
Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=user1/emailAddress=user1@apps4you.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
--- Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: CA:FALSE
Netscape Comment: OpenSSL Generated Certificate
X509v3 Subject Key Identifier: ---
-----Output ommited-----

Update 2: this slightly modified config file also doesn't work: https://gist.github.com/Xcess/599beaec17a4a524a2acbde1b7f5c70f

Update 3:
Verbose SSL Log file :

  • X.509 can be a complicated theme for someone not familiar with it. For starters, nowadays most of the modern OS/browsers are starting to refuse certificates with a key smaller than 2048 bits. see unix.stackexchange.com/questions/331979/webmin-stopped-opening – Rui F Ribeiro Mar 1 '17 at 11:46
  • I advise you to add the output of openssl x509 -in certificate.crt -text -noout to the post. Edit the relevant bits to take out private information. – Rui F Ribeiro Mar 1 '17 at 11:57
  • 1
    @RuiFRibeiro I added the output. Thanks. btw, this is a server error and client is not rejecting anything. – Mehran Mar 1 '17 at 12:43
  • I assume that is the client certificate. I am not seeing any X.509 extensions/ OIDs about being a certificate used for client authentication, hence the error... do you have any? – Rui F Ribeiro Mar 1 '17 at 13:03

You need to add a X.509 Extension to this cert to use it for client authentication.

In openssl.cnf, under [ usr_cert ], per the openssl.conf example:

[ usr_cert ]
nsCertType = client, email

However, supposedly the nsCertType is obsolete, and it is required to also add a X.509 extension. Add then a new section:

[ xpclient_ext]
extendedKeyUsage =

To add the extension, you will also need to pass the option -extensions xpclient_ext to openssl when generating the certificate.

The following extended key usage purposes are defined by RFC 3280:

serverAuth ( -- TLS Web server authentication
clientAuth ( -- TLS Web client authentication

Please do note that I advise to both add the nsCertType and the RFC 3280 extension. Some software, notably PfSense, still check for nsCertType.

  • Thanks for your answer, sorry for replying late. I'm going to test it today and report back the result. However I should say that the same certificate worked fine for NginX client certificate authentication. – Mehran Mar 3 '17 at 7:14
  • I set both options you said, and created a keypair with openssl command. the I signed it with CA.pl like usual. then converted to pkcs12 then imported into system and icedove. Still same error :( – Mehran Mar 3 '17 at 7:56
  • what errors have you in the log files? – Rui F Ribeiro Mar 3 '17 at 9:47
  • Please also add to the question the cert on the server side. – Rui F Ribeiro Mar 3 '17 at 9:52
  • log added @rui-f-ribeiro . you mean the CA or server cert? both are working fine by themselves. before client certificate everything was ok and also CA works fine. – Mehran Mar 3 '17 at 11:56

I found the answer so I thought I should post it here too. (precisely @behrad-eslamifar did :)

you should append the CRL to the CA certificate given to dovecot EVEN IF YOU HAVE SET ssl_require_crl = no

like this way :

openssl ca -gencrl -out crlfile
cat crlfile >> cacert.pem
service dovecot restart

thanks everyone for their suggestions. <3

  • Together with the bits about being client, no? Pretty interesting nonetheless, it may be worth filing a bug with the dovecot guys. – Rui F Ribeiro Mar 3 '17 at 15:46
  • cert type etc you mean? yes I changed those with no result. I've tried everything... :/ I agree It's worth filling a bug. Do so if you can please... – Mehran Mar 3 '17 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.