imapd via STARTLS not working after upgrade{SOLVED]

octavsly

Posted so other can find the solution easier.

After updating the net-mail/courier-imap to 4.15-r1, I could not retrieve the e-mails via STARTTLS anymore.
Strangely enough it still worked via SSL/TLS (port 993).

Tried debugging via http://www.courier-mta.org/authlib/README.authdebug.html but STARTTLS was not there.

Then found in the /var/log/messages the following error:

cilly · n00b Joined: 27 Jun 2006 Posts: 3

Thank you!!!!!!

:lol:

Floppe · n00b Joined: 27 Feb 2003 Posts: 50 Location: Finland

Many thanks!

Duncan Mac Leod · Guru Joined: 02 May 2004 Posts: 311 Location: Germany

Microsoft's last patchday (May 2015) introduced another problem, REQUIRING a DHE key length of 1,024 bits! (default is 768 if you are using OpenSSL and the mkdhparams tools).

If you are using a DHE key length of < 1,024 bits, a TLS connection is not possible.

https://support.microsoft.com/en-us/kb/3061518/

Two soultions:

#1 set the environment variable BITS (see manpage of mkdhparams)

or

#2 edit /usr/sbin/mkdhparams and change the value 768 to 1024

Generate a new .pem file and it will work again.

Took me hours to track down the problem, so I post this to make your life easier.

The problem occurs in our network ONLY for Windows 8.1 and Windows Server 2012 R2 systems, all other systems were not affected, but AFAIK Microsoft is planning to patch the other operating systems in the next months.

Hope that helps...

octavsly · Posted: Tue Jun 16, 2015 9:13 am Post subject:

Thanks Duncan Mac Leod for the info.

Reason for change can be seen in https://weakdh.org/

For regenerating the key use DH_BITS instead of BITS as the manual says.

mt_undershirt · n00b Joined: 20 Dec 2014 Posts: 4

Many thanks to octavsly and MacLeod, my thunderbird just failed on multiple accounts after today's upgrade to 38.0.1 with the aforementioned cryptic error message.
Connection was still working on other machines and iOS devices, though.

So, you probably saved me a lot of time otherwise wasted on tracking down the problem, I truly :!:

appreciate that.

As described, removing the old dhparams.pem and running 1024-bit modified mkdhparams on the server did the trick right away.

Regards
mtu

toralf · Posted: Tue Jun 16, 2015 11:30 am Post subject:

IMO re-creating the .pem file should be scheduled regularly, eg. via cron once per week/month or so, even if you're not paranoid.

F1r31c3r · Posted: Thu Jun 25, 2015 4:18 am Post subject: workaround for the user

Hi all,

I too came across this problem and after 2 hours with my hosting provider they provided me with reassurance but nothing more.

They told me they had fixed it twice but it still did not work so i decided to disable the use of the key and force Thunderbird to use a higher encryption key.

If you go to Edit -> Preferences, then the advanced and General tab. At the bottom is a button called Config Editor. Click it and enter this then use the filter to find all ssl3 entries.

Find