I am running dovecot dovecot-2.3.8-9.el8.x86_64
on CentOS Linux release 8.5.2111
I have nagios checks warning me if the imap certificate in about to expire. Recently I got just such an alert.
However, this seems to be inaccurate.
I check the actual certificate expiry date in my PEM certificate
# openssl x509 -enddate -noout -in cert.pem
notAfter=Apr 9 15:58:41 2023 GMT
Then I use openssl to check the certificate expiry date by connecting to the actual host
# openssl s_client -connect imap.myserver.net:993 | openssl x509 -noout -dates
depth=0 CN = imap.myserver.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = imap.myserver.net
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = imap.myserver.net
verify return:1
notBefore=Nov 10 08:44:28 2022 GMT
notAfter=Feb 8 08:44:27 2023 GMT
Then I restart dovecot
systemctl restart dovecot
And check again:
# openssl s_client -connect imap.myserver.net:993 | openssl x509 -noout -dates
depth=0 CN = imap.myserver.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = imap.myserver.net
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = imap.myserver.net
verify return:1
notBefore=Jan 9 15:58:42 2023 GMT
notAfter=Apr 9 15:58:41 2023 GMT
Now the date is correct. What's going on here? Is this a bug in Dovecot?