Dovecot rejecting client certificate

Question

I have configured dovecot to use Client certificate authentication. I have used CA.pl (openssl wrapper) to create CA cert and sign client and server certs with that.(no certificate chain, CA cert is trusted in client) I have set the certificate as CA certificate in dovecot for client auth. Dovecot correctly asks IceDove for certificates but after clicking OK, It fails with error "Client didn't present valid SSL certificate."

Using openssl to manually test IMAP connection also results in this error.

dovecot config: https://gist.github.com/Xcess/71f7eeeda0a270b252f1de5d7308c0e2

I have tried certificate with CN=user1 and [email protected]. both failed. Also set common-name to be username in dovecot conf...no difference.

I don't know what to do as this is all stated in manuals and seems pretty simple and straightforward. But it fails.

thanks

---

Update 1: output of command openssl x509 -in certificate.crt -text -noout:

Certificate: Data: Version: 3 (0x2) Serial Number: 8e:3d:9b:7c:13:35:88:b7
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IR, ST=Isf, O=Apps4you, CN=lnxsrv2
Validity
Not Before: Mar 1 10:45:32 2017 GMT
Not After : Mar 1 10:45:32 2018 GMT
Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=user1/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
--- Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: CA:FALSE
Netscape Comment: OpenSSL Generated Certificate
X509v3 Subject Key Identifier: ---
-----Output ommited-----

---

Update 2: this slightly modified config file also doesn't work: https://gist.github.com/Xcess/599beaec17a4a524a2acbde1b7f5c70f

---

Update 3:
Verbose SSL Log file :
https://gist.github.com/Xcess/f54850ecdaa6bcd044a77d133cb9b9c2

Answer 1

You need to add a X.509 Extension to this cert to use it for client authentication.

In openssl.cnf, under [ usr_cert ], per the openssl.conf example:

[ usr_cert ]
nsCertType = client, email

However, supposedly the nsCertType is obsolete, and it is required to also add a X.509 extension. Add then a new section:

[ xpclient_ext]
extendedKeyUsage = 1.3.6.1.5.5.7.3.2

To add the extension, you will also need to pass the option -extensions xpclient_ext to openssl when generating the certificate.

The following extended key usage purposes are defined by RFC 3280:

serverAuth (1.3.6.1.5.5.7.3.1) -- TLS Web server authentication
clientAuth (1.3.6.1.5.5.7.3.2) -- TLS Web client authentication

Please do note that I advise to both add the nsCertType and the RFC 3280 extension. Some software, notably PfSense, still check for nsCertType.

Answer 2

I found the answer so I thought I should post it here too. (precisely @behrad-eslamifar did :)

you should append the CRL to the CA certificate given to dovecot EVEN IF YOU HAVE SET ssl_require_crl = no

like this way :

openssl ca -gencrl -out crlfile
cat crlfile >> cacert.pem
service dovecot restart

thanks everyone for their suggestions. <3