STARTTLS available?

[Jorey Bump]

Marten Lehmann wrote:
> Hello,
> 
>> Good, now show us your imapd.conf and any tls errors that appear in 
>> your log.
> 
> configdirectory: /cyrus/config
> partition-default: /cyrus/spool
> admins: cyrus
> sievedir: /cyrus/config/sieve
> sendmail: /usr/sbin/sendmail
> 
> altnamespace: true
> hashimapspool: true
> unixhierarchysep: true
> virtdomains: userid
> allowusermoves: true
> 
> sasl_pwcheck_method: getpwent auxprop saslauthd
> sasl_mech_list: PLAIN
> 
> servername: test
> imaps_tls_cert_file: /cyrus/certs/imap.crt
> imaps_tls_key_file: /cyrus/certs/imap.key
> pop3s_tls_cert_file: /cyrus/certs/pop3.crt
> pop3s_tls_key_file: /cyrus/certs/pop3.key
> 
> lmtp_over_quota_perm_failure: true
> munge8bit: true
> username_tolower: true

You have not configured tls_cert_file or tls_key_file, only TLS for the 
imaps (normally port 993) and pop3s (normally port 995) services.

> There are no tls errors as TLS is working fine. Remember: pop3s is 
> running with ssl on port 995 all the time, same with imaps on port 993. 
> Whereas pop3 on port 110 and imap on port 143 are usually not encrypted. 
> But with STARTTLS you can encrypt the session while still connecting to 
> port 110/143, while you usually have to connect to the special ports to 
> get encrypted connections. However, the server must show that he 
> supports STARTTLS by mentioning it on the CAPABILITIES list, otherwise 
> clients aren't trying to use it.

Configure tls_cert_file and tls_key_file, which will be shared by imap, 
imaps, pop3, and pop3s by default. Unless you have a compelling reason 
for offering different certificates, delete your (imaps|pop3s)_tls_* 
entries from imapd.conf. When you enable these services in cyrus.conf, 
they will use the key/cert specified in tls_(key|cert)_file, unless 
overridden with the prefix of the service name used in cyrus.conf, as 
you have done.

Remember, imaps and pop3s (started with -s) do not use or offer 
STARTTLS, and configuration settings applied to them will have no effect 
on the standard imap or pop3 services.