Sorry for my late response – due to illness I was some days offline. > > Backports isn't really the place for this, for multiple reasons. It > should be fixed in the main archive. > > Unfortunately, I haven't been able to find a suitable looking change > from the 2.4.4..2.4.5 range upstream. I have also been unable to > come > up with a way to reproduce the failure.
Mee to 😉 I asked in the https://dovecot.org/mailman3/archives/users/0f8d81437b7e48e39f7fd13b0e57166d/ for the patch – maybe it helps. > > From your description, as well as the mailing list discussion, it > seems > like issue is that when a dovecot program is run as a user that does > not > have permission to access some file referenced in the configuration, > typically a TLS key. So, to try to reproduce this failure, I've set > up > the following and tested it with the dovecot 1:2.4.1+dfsg1-6 packages > from the original trixie release. I have not encountered any errors, > though, so something must be missing. Can you tell from here what's > missing? If you can provide a minimal repro configuration, that > would > be helpful. > [...] > > ssl_server { > cert_file = /etc/dovecot/private/tls/example.net.crt > key_file = /etc/dovecot/private/tls/example.net.key > } In difference to my ssl related configuration is: ssl = yes ssl_server_cert_file = /etc/dovecot/private/c42-client.cert.pem ssl_server_key_file = /etc/dovecot/private/c42-client.key.pem ssl_server_ca_file = /etc/ssl/certs/c42-srv-ca.crt ssl_min_protocol = TLSv1.2 ssl_server { cert_file = /etc/ssl/c42/c42-client.cert.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/ssl/private/c42-client.key.pem } Maybe your configuration is to „small“. I have the suspicion that the 'ssl = yes' is required – maybe more. Thanks for your all time investigation the issue. I would really like to go back to the stable debian version of dovecot instead being responsible for my own backport. Best Regards, H.-Dirk Schmitt
