Thunderbird and Outlook solution of problem with Courier IMAP sslv3 alert illegal parameter

E-mail clients like Thunderbird or Outlook stopped to communicate with Courier IMAP/SMTP/POP TLS after some upgrade.

The only clue in log file was this error message:

courier couriertls: accept: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter

The problem was that certificate for IMAP (/etc/courier/imapd.pem) and /etc/courier/dhparam.pem were containing too short key. The short key was sufficient in past for encrypted communication. Unfortunately maintainers of Debian package forgot to add fix for upgrade.

It is very simple to fix the issue. Just generate DH with sufficient length.

DH_BITS=2048 mkdhparams

This command will update /etc/courier/dhparm.pem.

Make sure to update all pem files in case that they contain DH record.

Restart services and clients should be able to reconnect without problem.

If you still experience some issues with PEM files check out article PEM routines:PEM_read_bio:no start line.

9. December 2015 at 20:33 - Software engineering (Tags: , , , , , , , ). Both comments and pings are currently closed.

0 0 votes
Article Rating
1 Comment
Inline Feedbacks
View all comments
David Dombrowsky
7 years ago

Thank you very much for this. It has brought my wee little mail server back to life. Not that I minded much using mutt all the time, but it’s nice to be able to use thunderbird again. :)