[Pkg-openssl-devel] Bug#924621: Bug#924621: openssl 1.1.1b-1 make fetchmail unusable

[Kurt Roeckx]

On Mon, Mar 18, 2019 at 01:55:50PM +0900, Atsuhito Kohda wrote:
> Hi Kurt,
> 
> > So from what I understand, the problem is really on the dovecot
> > side. What does dovecot's log show?
> > 
> > Dovecot can configure DH, which seems to default to:
> > ssl_dh = </usr/share/dovecot/dh.pem
> > 
> > That file should be fine, it's 4096 bit.
> 
> I generated 4096 bit dh_key:
> openssl dhparam -out /path/to/dh.pem 4096
> 
> then I modified a configuration file of dovecot as follows:
> ssl_dh=</path/to/dh.pem

So I assume that somewhere in the past you also did something like
that, and that the old file was still a 1024 bit file? Or did you
just not have an ssl_dh line in your config because the old config
files didn't have it and it wasn't added as part of the upgrade?

> then I restarted dovecot. Now fetch mail works fine
> after I upgraded openssl 1.1.1b-1 .

I have no idea which part of dovecot failed, but I think there
might still be some other issue.

Do you have any idea which version of TLS is being negotiated?
Since both use the same version of openssl, it should be able to
do TLS 1.3 and have used X25519 instead of DHE. It could be that
some side of the connection for some reasons blocks TLS 1.3.

The other reason it can fail is that the change between 1.1.1a and
1.1.1b now just caused dovecot to not properly set up TLS. That
you are in fact not using DHE, but that setting up DHE now failed,
causing the connection issue.


Kurt