Comments
mosvald
Opened a bug report for this for anyone hitting the same issue to find a solution:
Bug 2435251 - STARTTLS does not work with cyrus-imapd >=3.8.6 and >=3.10.2 https://bugzilla.redhat.com/show_bug.cgi?id=2435251
Mentioned this also in the update to 3.8.6:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-6362b1850b
For anyone coming here with a similar problem to this:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-93c7a550b9
After the update from cyrus 3.8 I can not connect to the server anymore. Lots of this error in the log: session ended: sessionid=<cyrus-1769669820-6072-1-14846267638718756014> userid=<> id.name=<(null)>
Trying to recreate the account in Thunderbird tells me it does not support TLS. Downgrade to 3.8 fixed the problem instantly .
This is expected behavior on 3.8.6/3.10.2:
https://www.cyrusimap.org/3.10/imap/download/release-notes/3.10/x/3.10.2.html
The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of implicit TLS over a dedicated port. STARTTLS is now disabled by default.
Installations that need to service clients that use opportunistic TLS should enable the allowstarttls imapd.conf(5) option for the services that need it. For example, for a service configured with the name imap in cyrus.conf(5), set imap_allowstarttls: on to enable STARTTLS.
The same applies to the 3.8.6 version:
https://www.cyrusimap.org/imap/download/release-notes/3.8/x/3.8.6.html
Fix options
- Use implicit TLS (recommended):
Configure clients to use IMAPS on port 993 (“SSL/TLS” in Thunderbird) instead of STARTTLS on 143.
- Re-enable STARTTLS (what your Thunderbird likely expects):
Enable STARTTLS for the relevant service(s) by setting the service-specific option in imapd.conf:
For the service named imap in cyrus.conf, add:
imap_allowstarttls: on
There is also the possibility of allowing this globally in /etc/imapd.conf
allowstarttls: 1
Cyrus-imapd supports both global and per-service variants.
Fix options
- Use implicit TLS (recommended):
Configure clients to use IMAPS on port 993 (“SSL/TLS” in Thunderbird) instead of STARTTLS on 143.
- Re-enable STARTTLS (what your Thunderbird likely expects):
Enable STARTTLS for the relevant service(s) by setting the service-specific option in imapd.conf:
For the service named imap in cyrus.conf, add:
imap_allowstarttls: on
There is also an allowstarttls setting (allowstarttls: 1) in /etc/imapd.conf. Cyrus-imapd supports both global and per-service variants.
Thank you for the valuable feedback!
This is expected behavior on 3.10.2:
https://www.cyrusimap.org/3.10/imap/download/release-notes/3.10/x/3.10.2.html
The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of implicit TLS over a dedicated port. STARTTLS is now disabled by default.
Installations that need to service clients that use opportunistic TLS should enable the allowstarttls imapd.conf(5) option for the services that need it. For example, for a service configured with the name imap in cyrus.conf(5), set imap_allowstarttls: on to enable STARTTLS.
The same applies to the 3.8.6 version:
https://www.cyrusimap.org/imap/download/release-notes/3.8/x/3.8.6.html
I am sorry for the disruption this change caused.
It would be more than welcome if anybody could test this
Thank you for the feedback, but I get that error only with the previous cyrus-imapd-3.8.1-1.fc39.x86_64 which didn't have the jmap support enabled:
# curl -X POST \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
--user joe:joe \
-d '{
"using": [ "urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail" ],
"methodCalls": [[ "Mailbox/get", {}, "c1" ]]
}' \
http://localhost/jmap/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method is not allowed for the URL.</p><hr><address>Cyrus-HTTP/3.8.1-1.fc39 Fedora Cyrus-SASL/2.1.28 Lib/XML2.10.4 Jansson/2.13.1 OpenSSL/3.1.0-dev Nghttp2/1.55.1 Zlib/1.2.13 Zstd/1.5.5 LibiCal/3.0 ICU4C/73.2 SQLite/3.42.0 Server at localhost Port 80</address></body></html>#
but with the version cyrus-imapd-3.8.1-4.fc39..x86_64 coming with this update I get the below:
# curl -X POST \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
--user joe:joe \
-d '{
"using": [ "urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail" ],
"methodCalls": [[ "Mailbox/get", {}, "c1" ]]
}' \
http://localhost/jmap/
{"methodResponses":[["Mailbox/get",{"state":"24","list":[{"id":"632be582-7b1a-465d-b2b3-0adac734cc10","name":"Inbox","parentId":null,"myRights":{"mayReadItems":true,"mayAddItems":true,"mayRemoveItems":true,"mayCreateChild":true,"mayDelete":false,"maySubmit":true,"maySetSeen":true,"maySetKeywords":true,"mayAdmin":true,"mayRename":false},"role":"inbox","totalEmails":0,"unreadEmails":0,"totalThreads":0,"unreadThreads":0,"sortOrder":1,"isSubscribed":false}],"notFound":[],"accountId":"joe"},"c1"]],"sessionState":"0"}#
Please, could you double-check the version installed on your system?
This update has been unpushed.
Thank you for all the feedback, cancelling this update due to problems it is causing or would cause.
Thank you for all the feedback, cancelling this update due to problems it is causing or would cause.
This update has been unpushed.
This update has been unpushed.
Gathering more feedback regarding the --no-terminate option (Increased positive karma to get this into stable), currently:
- ncat man page entry is missing for --no-terminate
- automated tests failed for some depending on this behavior
Gathering more feedback regarding the --no-terminate option (Increased positive karma to get this into stable), currently:
- ncat man page entry is missing for --no-terminate
- automated tests failed for some depending on this behavior
This update has been unpushed.
Opened a bug report for this for anyone hitting the same issue to find a solution:
Bug 2435251 - STARTTLS does not work with cyrus-imapd >=3.8.6 and >=3.10.2 https://bugzilla.redhat.com/show_bug.cgi?id=2435251