Courier SSL shared cipher error

[MichalisZ]

Hello,

yesterday we upgraded two of our servers to the latest Plesk 12.
The 1st server is an CentOS/CLoudlinux 6.x server and the 2nd an CentOS 5.x server.
Both of them were running Plesk 11.5 before the upgrade.

After the upgrade, we have the same issue in both servers which is that the START/TLS, SSL protocols at Courier imaps or pop3s do not work, and mail clients (outlook, thunderbird) return that the password is wrong when they connect over a secure connection.
In both of them, at the /var/log/maillog, we are getting the same messages, as the following one:
--------------------------------------------------------------------------
courier-imaps: couriertls: connect: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
--------------------------------------------------------------------------

As the issue is in both server, we believe thath it there is a bug in the new version or the update script.
So any clues how we could fix it?

We have already checked all configurations which seem ok, tried to... reboot the machines, mailchk repair, but nothing seems to work.

Thank you

 

[MichalisZ]

We have found the cause...

at our servers we use our own .pem certificates for the ssl/tls connections as the default ones are not valid for the hostname or have expired.
So as it was stated in an KB we have added at the imapd-ssl.conf pop3d-ssl.conf the paths to our pem files, eg
-------------------------------------------------------------------------------
TLS_CERTFILE=/opt/ssl/certs/courier/imapd.pem
-------------------------------------------------------------------------------

But althought the update says that does not change the files...
-------------------------------------------------------------------------------
warning: /etc/courier-imap/imapd created as /etc/courier-imap/imapd.rpmnew
warning: /etc/courier-imap/imapd-ssl created as /etc/courier-imap/imapd-ssl.rpmnew
warning: /etc/courier-imap/pop3d created as /etc/courier-imap/pop3d.rpmnew
warning: /etc/courier-imap/pop3d-ssl created as /etc/courier-imap/pop3d-ssl.rpmnew
-------------------------------------------------------------------------------
something (possibly later on the update process) changes them, and the custom pem paths are gone.

So we have reverted the right configuration and the SSL/TLS connections seem to work fine.