title: Postfix/Dovecot SSL configuration
body: <p>I've had a Ubuntu 14.04 server configured and running fine for some time now. There are web, ftp and mail server installed and functioning properly on it. A week ago the SSL certificate that I had been using to connect to the management console and for mail expired and I went ahead and acquired a new one from StartSSL.</p>
  
  <p>The new certificate is for mail.mydomain.com. The <strong>Postfix (main.cf)</strong> configuration contains the following:</p>
  
  <pre><code>smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
  biff = no
  # appending .domain is the MUA's job.
  append_dot_mydomain = no
  # Uncomment the next line to generate "delayed mail" warnings
  #delay_warning_time = 4h
  readme_directory = /usr/share/doc/postfix
  # TLS parameters
  smtpd_tls_cert_file = /etc/postfix/mail.crt
  smtpd_tls_key_file = /etc/postfix/mail.key
  smtpd_use_tls = yes
  smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  myhostname = mail.mysite.com
  alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
  alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
  myorigin = /etc/mailname
  mydestination = mail.mysite.eu, localhost, localhost.localdomain
  </code></pre>
  
  <p><strong>Dovecot.conf</strong></p>
  
  <pre><code>protocols = imap pop3
  auth_mechanisms = plain login
  disable_plaintext_auth = no
  log_timestamp = "%Y-%m-%d %H:%M:%S "
  mail_privileged_group = vmail
  postmaster_address = postmaster@saturn13.eu
  ssl_cert = &lt;/etc/postfix/mail.crt
  ssl_key = &lt;/etc/postfix/mail.key
  ssl_protocols = !SSLv2 !SSLv3
  </code></pre>
  
  <p><strong>Dovecot/conf.d/10-ssl.conf</strong></p>
  
  <pre><code>ssl = yes
  ssl_cert = &lt;/etc/postix/mail.crt
  ssl_key = &lt;/etc/postfix/mail.key
  </code></pre>
  
  <p>I read that StartSSL requires an intermediate and root CA to be installed, so I tried concatenating them into a <strong>mail.pem</strong> file which I then proceeded to set in both Postfix and Dovecot. Try as I might, every time I ran openSSL test, the results were like this:</p>
  
  <pre><code>root@server:/etc/dovecot# openssl s_client -connect mail.mysite.com:465
  CONNECTED(00000003)
  write:errno=104
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 0 bytes and written 305 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  ---
  </code></pre>
  
  <p>What's even more puzzling for me is the fact that when I try to connect to the account with Thunderbird, a popup window appears asking to confirm a security exception for <strong>www.mysite.com:443</strong>.</p>
  
  <p>So, could you help me figure out what's wrong in this configuration? When I open the mail.crt file in Windows, everything appears normal. So why can't I connect to the server and why is Thunderbird trying to connect to <strong>www</strong> and on port <strong>443</strong>?</p>
  
  <p>Thank you!</p>