Dovecot is showing the wrong expiration date for the imap certificate

Question

I am running dovecot dovecot-2.3.8-9.el8.x86_64 on CentOS Linux release 8.5.2111

I have nagios checks warning me if the imap certificate in about to expire. Recently I got just such an alert.

However, this seems to be inaccurate.

I check the actual certificate expiry date in my PEM certificate

# openssl x509 -enddate -noout -in cert.pem
notAfter=Apr  9 15:58:41 2023 GMT

Then I use openssl to check the certificate expiry date by connecting to the actual host

# openssl s_client -connect imap.myserver.net:993 | openssl x509 -noout -dates
depth=0 CN = imap.myserver.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = imap.myserver.net
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = imap.myserver.net
verify return:1
notBefore=Nov 10 08:44:28 2022 GMT
notAfter=Feb  8 08:44:27 2023 GMT

Then I restart dovecot

systemctl restart dovecot

And check again:

# openssl s_client -connect imap.myserver.net:993 | openssl x509 -noout -dates
depth=0 CN = imap.myserver.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = imap.myserver.net
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = imap.myserver.net
verify return:1
notBefore=Jan  9 15:58:42 2023 GMT
notAfter=Apr  9 15:58:41 2023 GMT

Now the date is correct. What's going on here? Is this a bug in Dovecot?

Answer 1

As with many other servers (nginx ...) - if the certificate for the server gets changed, then a restart of the server is required so that the server can read the new certificate. You probably missed that since as shown a restart fixed the problem.