Courier does not work with courier-ssl installed

Question

I have been trying to enable SSL on my courier IMAP server running Ubuntu 14.04. I installed courier-ssl and courier-imap-ssl. Then the server stopped working completely, with an "authentication error" in Rainloop webmail. This happens regardless of whether or not the courier-imap-ssl service is started, and is resolved if and only if courier-ssl is uninstalled.

What could be the problem here, and how would I go about enabling SSL?

With courier-ssl installed and courier-imap-ssl running, I get this error if I run openssl s_client -connect localhost:993:

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1463335379
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

And this error if I run telnet localhost 993:

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

Answer 1

I recommend to use openssl to connect to SSL services. Plain telnet is not able to communicate with encrypted connection:

openssl s_client -connect localhost:993

You can verify service by typing following command after establishing connection:

A login MYUSERNAME MYPASSWORD

Response should be:

A OK LOGIN Ok.

One option how to fix incorrect installation is to completely remove the service even with configuration:

apt-get remove --pure courier-imap-ssl

and reinstall it again.

Problems with SSL are often related to certificates and one reason could be that /etc/courier/dhparams.pem were not generated correctly. DH params could be regenerated by mkdhparams command.