Fail to add external account from Zimbra5_NE server in my new Zimbra6_OSS

[globus2505]

Hello everybody,
- I got problem when i tried to add external account from Zimbra5_NE server in my new Zimbra6_OSS(Zimbra version 6_RC Opensource edition) server.

- When i use IMAP & POP, it appearred "Error: Connection refused"
- I try to use IMAPS or POPS, I got below problem:

+ The error message:
Error: d2:CN26:myserver.com1:O26:Zimbra Collaboration Suite2:OU26:Zimbra Collaboration Suite6:accept4:true5:alias24:192.168.1.252:1244778 6984:fromi1244778698000e4:host13:192.168.1.2523:ic n24:myserver.com2:io26:Zimbra Collaboration Suite3:iou26:Zimbra Collaboration Suite3:md532:85D9AB8E57AB6E1A0B93D714A48E03138:mis match5:false1:s10:12447786984:sha140:9B31676C58542 CBBE5C578E20DCD229FF825D1292:toi1276314698000ee

+ Log file /opt/zimbra/log/mailbox.log

com.zimbra.common.service.ServiceException: system failure: Unable to connect to IMAP server: DataSource: { id=TestId, type=imap, isEnabled=false, name=Test, host=192.168.1.252, port=993, connectionType=ssl, username=myuser@myserver.com, folderId=-1 }
ExceptionId:btpool0-39:1249552208538:3856ed9f2316dd1b
Code:service.FAILURE
at com.zimbra.common.service.ServiceException.FAILURE (ServiceException.java:251)
at com.zimbra.cs.datasource.ImapSync.connect(ImapSync .java:196)
at com.zimbra.cs.datasource.ImapSync.test(ImapSync.ja va:121)
at com.zimbra.cs.datasource.DataSourceManager.test(Da taSourceManager.java:57)
at com.zimbra.cs.service.mail.TestDataSource.handle(T estDataSource.java:125)
at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEng ine.java:415)
at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.jav a:273)
at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.jav a:157)
at com.zimbra.soap.SoapServlet.doPost(SoapServlet.jav a:273)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:727)
at com.zimbra.cs.servlet.ZimbraServlet.service(Zimbra Servlet.java:187)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:820)
at org.mortbay.jetty.servlet.ServletHolder.handle(Ser vletHolder.java:502)
at org.mortbay.jetty.servlet.ServletHandler$CachedCha in.doFilter(ServletHandler.java:1148)
at org.mortbay.servlet.UserAgentFilter.doFilter(UserA gentFilter.java:81)
at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter .java:129)
at org.mortbay.jetty.servlet.ServletHandler$CachedCha in.doFilter(ServletHandler.java:1139)
at org.mortbay.jetty.servlet.ServletHandler.handle(Se rvletHandler.java:378)
at org.mortbay.jetty.security.SecurityHandler.handle( SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(Se ssionHandler.java:181)
at org.mortbay.jetty.handler.ContextHandler.handle(Co ntextHandler.java:765)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebA ppContext.java:417)
at org.mortbay.jetty.handler.ContextHandlerCollection .handle(ContextHandlerCollection.java:230)
at org.mortbay.jetty.handler.HandlerCollection.handle (HandlerCollection.java:114)
at org.mortbay.jetty.handler.HandlerWrapper.handle(Ha ndlerWrapper.java:152)
at org.mortbay.jetty.handler.rewrite.RewriteHandler.h andle(RewriteHandler.java:230)
at org.mortbay.jetty.handler.HandlerWrapper.handle(Ha ndlerWrapper.java:152)
at org.mortbay.jetty.Server.handle(Server.java:324)
at org.mortbay.jetty.HttpConnection.handleRequest(Htt pConnection.java:535)
at org.mortbay.jetty.HttpConnection$RequestHandler.co ntent(HttpConnection.java:886)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser. java:747)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpPa rser.java:218)
at org.mortbay.jetty.HttpConnection.handle(HttpConnec tion.java:404)
at org.mortbay.io.nio.SelectChannelEndPoint.run(Selec tChannelEndPoint.java:409)
at org.mortbay.thread.BoundedThreadPool$PoolThread.ru n(BoundedThreadPool.java:451)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: d2:CN26:myserver.com1:O26:Zimbra Collaboration Suite2:OU26:Zimbra Collaboration Suite6:accept4:true5:alias24:192.168.1.252:1244778 6984:fromi1244778698000e4:host13:192.168.1.2523:ic n24:myserver.com2:io26:Zimbra Collaboration Suite3:iou26:Zimbra Collaboration Suite3:md532:85D9AB8E57AB6E1A0B93D714A48E03138:mis match5:false1:s10:12447786984:sha140:9B31676C58542 CBBE5C578E20DCD229FF825D1292:toi1276314698000ee
at com.sun.net.ssl.internal.ssl.Alerts.getSSLExceptio n(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(S SLSocketImpl.java:1611)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Ha ndshaker.java:187)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Ha ndshaker.java:181)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serv erCertificate(ClientHandshaker.java:1035)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.proc essMessage(ClientHandshaker.java:124)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoo p(Handshaker.java:516)
at com.sun.net.ssl.internal.ssl.Handshaker.process_re cord(Handshaker.java:454)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRec ord(SSLSocketImpl.java:884)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.perform InitialHandshake(SSLSocketImpl.java:1112)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHa ndshake(SSLSocketImpl.java:1139)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHa ndshake(SSLSocketImpl.java:1123)
at com.zimbra.common.util.CustomSSLSocket.startHandsh ake(CustomSSLSocket.java:213)
at com.zimbra.common.util.CustomSSLSocket.getInputStr eam(CustomSSLSocket.java:347)
at com.zimbra.cs.mailclient.MailConnection.connect(Ma ilConnection.java:83)
at com.zimbra.cs.datasource.ImapSync.connect(ImapSync .java:179)
... 33 more
Caused by: java.security.cert.CertificateException: d2:CN26:myserver.com1:O26:Zimbra Collaboration Suite2:OU26:Zimbra Collaboration Suite6:accept4:true5:alias24:192.168.1.252:1244778 6984:fromi1244778698000e4:host13:192.168.1.2523:ic n24:myserver.com2:io26:Zimbra Collaboration Suite3:iou26:Zimbra Collaboration Suite3:md532:85D9AB8E57AB6E1A0B93D714A48E03138:mis match5:false1:s10:12447786984:sha140:9B31676C58542 CBBE5C578E20DCD229FF825D1292:toi1276314698000ee
at com.zimbra.common.util.CustomTrustManager.checkSer verTrusted(CustomTrustManager.java:89)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serv erCertificate(ClientHandshaker.java:1027)
... 44 more



Is it the problem is my new server Zimbra6_OSS's certificate?

Please give me your idea about this?
Thanks.

[veronica]

In IMAPS which you tried seems its a problem of cert exception : -

Caused by: java.security.cert.CertificateException: d2:CN26:myserver.com1:O26:Zimbra Collaboration Suite2:OU26:Zimbra Collaboration Suite6:accept4:true5:alias24:192.168.1.252:1244778

[globus2505]

Thanks for your comment.
I also thought that it had a problem with ZImbra 6.0's certificate.
but I try with Gmail IMAPS is ok and can fetch email very smooth.
What differrent between Zimbra5_NE & Zimbra6_OSS certificates?
Experts, how can I fixed this problem?
Thanks

[veronica]

Gmail is using commercial cert. What server are you connecting to ? Does it have self signed cert ? Also u might want to look at Bug 39951 – Not able to configure IMAP, POP accounts - throws "invalid request: invalid type: dsrc, valid values: [pop3, imap, caldav, live, yab, rss, cal, gal, xsync]" exception

[globus2505]

Hi,
I did not change any cert from my Zimbra6_OSS installation until now(Use default installation).
I used Zimbra6_OSS to fetch email by IMAPS to Zimbra5_NE server outside.
Thanks.

[Fooshnik]

Has anyone found a fix for this? I'm having the same error adding an external account through IMAPS from one Zimba 6 server to another. IMAPS works fine with Thunderbird, my cell phone, etc.

[mmorse]

This looks to be caused by self-signed certificates.
zmlocalconfig -e "data_source_trust_self_signed_certs=true"
Or install the external cert into the server keystore manually.

~

There's also ssl_allow_untrusted_certs/ssl_allow_accept_untrusted_certs/ssl_allow_mismatched_certs but I think we only make use of those in ZD.

Now when admins just set data_source_trust_self_signed_certs true to workaround this issue, users have absolutely no warning 'allow?' prompt if something should actually be amiss with another self-signed cert elsewhere next time.

Need a RFE for a new data_source_allow_accept_trust_self_signed_certs, or for ZCS to use those ZD values instead which are all true now by default.