IMAP TLS Problems after upgrade to 4.5.3

[shanson]

Hi,

we upgraded to 4.5.3 (from 4.5.1) over the weekend. We first had an issue with plain IMAP, now we have an issue with IMAP with TLS.

1) Immediately after the upgrade plain IMAP was broken. We had activated the imapproxy for both ports 143 and 993. After activating the imapproxy only for port 993 we were then able to use plain IMAP again.

2) Now IMAP with TLS doesn't work. Having the clients switch to SSL as a workaround enables them to read mail.

Since the upgrade we're getting a lot of entries in /opt/zimbra/log/mailbox.log like this:

2007-03-19 10:15:01,686 INFO  [IMAP-143-W5177] [cid=5176;ip=10.10.10.11;] imap - exception occurred during read task
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
        at com.sun.net.ssl.internal.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:152)
        at com.sun.net.ssl.internal.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:759)
        at com.sun.net.ssl.internal.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:674)
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:566)
        at com.zimbra.cs.ozserver.OzTLSFilter.handshake(OzTLSFilter.java:146)
        at com.zimbra.cs.ozserver.OzTLSFilter.read(OzTLSFilter.java:244)
        at com.zimbra.cs.ozserver.OzConnection$ReadTask.doTask(OzConnection.java:469)
        at com.zimbra.cs.ozserver.OzConnection$Task.run(OzConnection.java:368)
        at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:595)

What have we done wrong? :-)

__________________
Scott Hanson
Media Ventures GmbH
Cologne, Germany

[phoenix]

Have you tried setting it to SSL?

[shanson]

Originally Posted by phoenix

Have you tried setting it to SSL?

Setting what to SSL?

Having the client use SSL instead of TLS works, but we'd like to have TLS working again.

[jholder]

Try to regenerate your certs to see if that helps.

[dkarp]

Originally Posted by shanson

Since the upgrade we're getting a lot of entries in /opt/zimbra/log/mailbox.log like this:

2007-03-19 10:15:01,686 INFO  [IMAP-143-W5177] [cid=5176;ip=10.10.10.11;] imap - exception occurred during read task
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
        at com.sun.net.ssl.internal.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:152)
        at com.sun.net.ssl.internal.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:759)
        at com.sun.net.ssl.internal.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:674)
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:566)
        at com.zimbra.cs.ozserver.OzTLSFilter.handshake(OzTLSFilter.java:146)
        at com.zimbra.cs.ozserver.OzTLSFilter.read(OzTLSFilter.java:244)
        at com.zimbra.cs.ozserver.OzConnection$ReadTask.doTask(OzConnection.java:469)
        at com.zimbra.cs.ozserver.OzConnection$Task.run(OzConnection.java:368)
        at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:595)

Looks like the proxy is forwarding to the IMAPs port instead of to the IMAP port. This is a problem, because the proxy isn't speaking IMAPs. If you make the proxy speak to the IMAP port, things should work.