Ttyjfyk

I set up Dovecot and Postfix, but when I try to authenticate with Thunderbird, it gives this error: "Thunderbird failed to find the settings for your email account."

==> /var/log/dovecot-info.log <==
Apr 06 10:42:16 auth: Debug: auth client connected (pid=13243)
Apr 06 10:42:16 imap-login: Info: Disconnected (no auth attempts): rip=76.xx.xx.xx, lip=172.31.15.65, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42

==> /var/log/maillog <==
Apr 6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: lost connection after UNKNOWN from user-xxxxxx.cable.mindspring.com[76.xx.xx.xxx]
Apr 6 10:42:16 ip-172-31-15-65 postfix/smtpd[13238]: disconnect from user-xxxxxx.cable.mindspring.com[76.xx.xx.xx]

I can connect with telnet.

Here is the Thunderbird error.

I had similar problems with Thunderbird on Mac OSX and a new StartSSL cert.
Thunderbird uses OCSP to validate the certificates and fails silently in this special case. Additionally the StartSSL OCSP server need some time to update the catalogue of known certificates (compare with https://forum.startcom.org/viewtopic.php?t=2654).

To check if OCSP is the cause of the trouble disable it temporarily and retry to connect to your server.

Preferences -> Advanced -> Certificates -> Validation -> Uncheck "Use the Online Certificate Status Protocol (OCSP) to confirm the current validity of certificates"

There MUST be a bug in Thunderbird. Even though I imported the server's certificate and added an exception, and it validates with openssl client, Thunderbird still fails. I was able to get it to work by using non-encrypted port numbers, but at least it uses STARTTLS to enable encryption anyways. I must star this to remember it a year from now.

$ openssl s_client -connect olixxxxx.xxx:993
CONNECTED(00000003)
... lots of certificate info ...
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready.
. login staxxxxxx xxxxxxxxpasswordxxxxxxxxxxxx
. OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in
. logout
* BYE Logging out

It's not a bug of Thunderbird.

Check that /etc/dovecot/dovecot.pem refers to the right SSL certificate you bought

Also update the CA authority in /etc/dovecot/dovecot.ca.pem

Then restart dovecot:

service dovecot restart

For postfix to work with Thunderbird's 'SSL/TLS' setting for port 465, use master.cf settings like this:

smtps inet n - y - - smtpd
 -o syslog_name=postfix/smtps
 -o smtpd_tls_wrappermode=yes
 -o smtpd_sasl_auth_enable=yes

(The 'y' in the first line is if postfix runs chrooted, otherwise it should be 'n')

This is a deprecated way to connect - it's more normal these days to use STARTTLS over port 587 ('submission').

Just a note - RFC 8314 - which is AFTER the answer by @gogoud - has once again standardized Port 465 for submission with implicit TLS using SMTPS and had deprecated submission via Port 587 as obsolete.

RFC 8314 also requires TLS 1.2 or better for connecting to a Mail Service Agent.

This drove me mad!!!

In my case an existing setup stopped working when I've updated the outgoing and incoming server domain addresses, everything else stayed the same yet I was not connecting and getting ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 in the logs.

There must be some bug in Thunderbird...as the solutios was to delete the Thunderbird account and re-create it.

To help you save some time I've also tried the below with no succeess:

• Thunderbird advanced settings from here: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921/6
  


• triple checked my dovecot.conf SSL setup

Again like in my case, if all else fails try just deleting and re-creating the accounts.