After webtop update (just now) cannot login into my mail!

WebTop
, ,
7

You didn’t answer my questions.

Anyway, I got more information this morning. Login issues were reported on installations with expired or self-signed certificates. The hypothesis is that since Dovecot advertises STARTTLS on the internal IMAP connection, a new Webtop library may try to enable encryption and fail.

Additional symptoms include Dovecot log lines like:

Sep 30 08:23:38 rl1 dovecot[106831]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000416:SSL routines::ssl/tls alert certificate unknown: SSL alert number 46 (no auth attempts in 0 secs): user=<>, rip=10.5.4.1, lip=10.5.4.1, TLS handshaking: SSL_accept() failed: error:0A000416:SSL routines::ssl/tls alert certificate unknown: SSL alert number 46, session=<GeQjBK9cpI4KBQQB>

And Webtop:

Sep 30 08:23:40 rl1 webapp[34271]: 2026-09-30 10:23:40 [ERROR] com.sonicle.webtop.mail.MailAccount - Error connecting to the mail server 10.5.4.1
Sep 30 08:23:40 rl1 webapp[34271]: jakarta.mail.MessagingException: STARTTLS failure

Sonicle developers are investigating the issue on their side.

I’ll keep you posted. In the meantime, please check the IMAP server’s certificate to see if this could be your case, for example:

openssl s_client -connect 10.5.4.1:143 -starttls imap </dev/null | grep ^Verify

If that’s the case, you may try this workaround. Add to Dovecot custom configuration this fragment:

local 10.5.4.1 {
  ssl = no
}

Replace the IP 10.5.4.1 with the VPN IP address of your node.

How to apply Dovecot custom configuration is described in Dovecot custom config. The procedure below was generated by Kapa:

Here’s how to add that fragment to the Dovecot custom configuration on NethServer 8:

  1. Enter the mail module agent environment (replace mail1 with your actual instance name):

    /usr/local/bin/runagent -m mail1

  2. Open the custom configuration file for editing:

    podman exec -ti dovecot vi /etc/dovecot/local.conf.d/myoverride.conf

  3. Add your fragment to the file:

    local 10.5.4.1 {
  ssl = no
}

  4. Reload Dovecot to apply the changes:

    systemctl --user reload dovecot

  5. Verify the services are still running correctly:

    systemctl --user status postfix dovecot

:warning: You can also check the effective configuration with podman exec -ti dovecot doveconf -n before and after the change. Be aware that modifying Dovecot defaults can be dangerous.