Without client certificate configuration, the user can retrieve its emails on the dovecot IMAPs server using a password.
When I try to authenticate the user with an S/MIM… (read more)
Without client certificate configuration, the user can retrieve its emails on the dovecot IMAPs server using a password.
When I try to authenticate the user with an S/MIME client certificate, the dovecot server reports that:
```dovecot: imap-login: Login aborted: Connection closed (client didn't send a cert) (client_ssl_cert_missing)```
Here is the configuration:
1. On the client side:
I've imported into thunderbird:
- the self-signed CA certificate
- the user's S/MIME client certificate which is fine:
```
- pk12util -l user@example.com.p12
Enter password for PKCS12 file:
Certificate(has private key):
Data:
Version: 3 (0x2)
Serial Number:
00:c3:10:d5:01:d1:9c:3c:4c:26:a7:a9:4d:90:f0:49:
03:a8:f3:71:d6
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "O=Example,ST=Yvelines,C=FR"
Validity:
Not Before: Mon Feb 23 14:26:26 2026
Not After : Thu Feb 21 14:26:26 2036
Subject: "E=user@example.com,CN=user@example.com,O=Example,ST=Yvel
ines,C=FR"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
c7:f9:af:0a:53:72:a9:de:f0:db:bb:ad:86:90:15:f1:
...
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Data: Is not a CA.
Name: Certificate Key Usage
Usages: Digital Signature
Non-Repudiation
Key Encipherment
Name: Extended Key Usage
E-Mail Protection Certificate
Name: Certificate Subject Key ID
Data:
68:5f:60:6d:8b:c8:0c:28:e3:d9:49:ca:bd:c7:25:a0:
24:4c:2c:40
Name: Certificate Authority Key Identifier
Key ID:
00:eb:69:5d:78:80:7f:1b:7f:e3:2b:fa:15:c3:9b:e6:
68:98:fa:f6
Name: Certificate Subject Alt Name
RFC822 Name: "user@example.com"
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
71:1b:e4:78:b0:21:f7:20:78:50:80:87:c8:71:a2:9c:
...
Fingerprint (SHA-256):
7F:8D:00:DF:04:02:39:90:11:B2:7D:5F:D3:EE:A7:2D:EF:58:B3:A9:4B:79:ED:D5:FE:2A:70:74:06:33:ED:31
Fingerprint (SHA1):
4E:7C:3B:31:58:32:8A:C3:42:26:CB:D3:DB:54:95:C5:C1:06:19:14
Key(shrouded):
Encryption algorithm: PKCS #5 Password Based Encryption v2
Encryption:
KDF: PKCS #5 Password Based Key Derive Function v2
Parameters:
Salt:
f2:73:28:5b:0b:6c:36:ec:1f:ca:1d:19:b3:77:87:7e
Iteration Count: 2048 (0x800)
KDF algorithm: HMAC SHA-256
Cipher: AES-256-CBC
Args:
04:10:be:da:bb:10:d3:94:e0:82:b3:2b:c2:ad:39:b5:
3b:4e
```
I've setup the account to
- use its certificate
- use a TLS certificate as an authentication method. There is no S/MIME certificate option.
2. On the dovecot (2.4.1) server side:
The server is configured to require client certificates for all IMAP connection:
```
protocol imap {
ssl_server_ca_file = /etc/ssl/CA_CRL.pem
ssl_server_request_client_cert = yes
ssl_server_cert_username_field = commonName
auth_ssl_require_client_cert=yes
auth_ssl_username_from_cert = yes
}
```
Does that mean that I also have to import a TLS client certificate? If so, what format should it (.p12, .crt...) be?
