Bug 50192 - Let's encrypt sets mail/dovecot/ssl/cafile, but should not
Summary: Let's encrypt sets mail/dovecot/ssl/cafile, but should not
Status: RESOLVED WONTFIX
Alias: None
Product: UCS
Classification: Unclassified
Component: Let's Encrypt
Version: UCS 4.4
Hardware: Other Linux
: P5 normal
Target Milestone: ---
Assignee: UCS maintainers
QA Contact: UCS maintainers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-09-13 16:53 CEST by Sönke Schwardt-Krummrich
Modified: 2024-06-27 12:10 CEST (History)
0 users

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 3: Simply Wrong: The implementation doesn't match the docu
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 1: Nuisance – not a big deal but noticeable
User Pain: 0.017
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sönke Schwardt-Krummrich univentionstaff 2019-09-13 16:53:17 CEST
According to 
https://wiki.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verification.2Fauthentication
the option "ssl_ca = < /path/to/ca.crt" is used, to verify CLIENT certificates during client authentication. 
So, I do not see, why the Let's encrypt root CA is defined here (via UCRV "mail/dovecot/ssl/cafile"), since clients usually do not use LE certificates for authentication.

By default, "ssl_verify_client_cert = yes" is automatically set by the UCR template if "mail/dovecot/ssl/cafile" is set, which causes dovecot to ask clients to send a certificate during authentication. 
Luckily, auth_ssl_require_client_cert = yes" is not set by default. Otherwise, no client would be able to connect to dovecot. If a client automatically sends a certificate, I suspect that it will fail with the LE root CA set in the option "ssl_ca".

Due to Bug 50105, the config option "ssl_ca" is currently not correctly filled with a proper root CA, which might prevent problems with certificate-sending clients and LE app on the mailserver.
Comment 1 Jan-Luca Kiok univentionstaff 2024-06-27 12:10:31 CEST
This issue has been filed against UCS 4.4.

UCS 4.4 is out of general maintenance and components may have vastly changed in later releases. Thus, this issue is now being closed.

If this issue still occurs in newer versions, please use "Clone this bug" or reopen this issue. In this case please provide detailed information on how this issue is affecting you.