Using Dovecot version 2.1.7, I've gotten client certificates working with fairly little effort, and at this point I can choose between having password authentication after the certificate check or make certificates mandatory and skip passwords altogether. What I'd like to do is retain optional certificate authentication and disable passwords only if the user employs a certificate.
The idea would be that users with mobile devices can be issued device-specific keys/certificates that can be revoked in the event of theft without affecting the ability of the user's other clients to log in.
What I'm trying to do appears impossible from my reading of the documentation, but perhaps somebody on here has managed it.
