Red Hat Bugzilla – Bug 20931
imap-2000 ssl does not log failure to find certificate
Last modified: 2007-04-18 12:29:51 EDT
if a server was running imap-4.x for imaps, then the certificate file it used was $path_to_certificates/stunnel.pem, since stunnel handled ssl. in imap-2000, imapd handles ssl, and the certificate name has changed to $path_to_certificates/imapd.pem. however, imapd-2000 does not log an error condition when this file does not exist. net effect: upgrade to imap-2000 silently breaks imaps service, and there are no clues in the /var/log/* to indicate what happened. i did 'strace -f -p pid-of-xinetd' and watched the imapd process come up and fail; i believe this to be the only way to diagnose the failure. for added annoyance points: the certificate path/name looked for by imapd is not documented.
The breakage happens because the SSL functionality in the web server allows it to serve IMAP-over-SSL without use of stunnel. The certificate needed is /usr/share/ssl/certs/imapd.pem. I'll add a note to the package to that effect, though I'm puzzled that the configuration file for the older imaps setup (which used stunnel) would have been replaced if it was ever modified with chkconfig or ntsysv.
this wouldn't make it easier for anyone to fix the problem as the RPM is still broken. adding (on %files): %ghost %config(noreplace,missingok) %{_datadir}/ssl/certs/imapd.pem %ghost %config(noreplace,missingok) %{_datadir}/ssl/certs/ipop3d.pem would make it easier for anyone to know which is the correct name for the certificate that would be needed for each service. a %post script *could* be designed to run on updates and link the current stunnel.pem if there is any and if /etc/xined.d/{imaps,pop3s} is using stunnel, but taking that stunnel.pem is not automatically installed and trustable on default i think it should be better left on the admin hands.
A great number of imap issues are fixed in the pending errata release of 2000c. Including upgrades. Please upgrade to it when it is released. Realistically, imapd logging changes will have to be done upstream, so I ask that you request this feature to the developers of UW imap at: pine@cac.washington.edu.