E-mail clients like Thunderbird or Outlook stopped to communicate with Courier IMAP/SMTP/POP TLS after some upgrade.
The only clue in log file was this error message:
courier couriertls: accept: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter
The problem was that certificate for IMAP (/etc/courier/imapd.pem) and /etc/courier/dhparam.pem were containing too short key. The short key was sufficient in past for encrypted communication. Unfortunately maintainers of Debian package forgot to add fix for upgrade.
It is very simple to fix the issue. Just generate DH with sufficient length.
DH_BITS=2048 mkdhparams
This command will update /etc/courier/dhparm.pem.
Make sure to update all pem files in case that they contain DH record.
Restart services and clients should be able to reconnect without problem.
If you still experience some issues with PEM files check out article PEM routines:PEM_read_bio:no start line.
Thank you very much for this. It has brought my wee little mail server back to life. Not that I minded much using mutt all the time, but it’s nice to be able to use thunderbird again. :)