Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have our own CA that signed this certificate. Our CA's public cert is in /etc/ssl/certs on the server. It appears that Courier is not trusting or finding the CA cert?

I've added the CA to /usr/share/ca-certificates/ and ran ~sudo dpkg-reconfigure ca-certificates~, adding it to the client. No change.

This is my conversation with Courier from a remote client:

openssl s_client -connect
+OK Hello there.
+OK Password required.
PASS 12345
+OK logged in.
+OK POP3 clients that break here, they violate STD53.
depth=0 /C=US/ST=State/L=My City/O=mycompany, Inc/OU=Mail Server/
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/ST=State/L=My City/O=mycompany, Inc/OU=Mail Server/
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/ST=State/L=My City/O=mycompany, Inc/OU=Mail Server/
verify error:num=21:unable to verify the first certificate
verify return:1

How do I make Courier use the cert? Or is this a client issue?

Update: Adding the CAs Public Cert in the .pem file (mail server key + mail server cert + ca cert) removes the previos errors, and replaces it with:

verify error:num=19:self signed certificate in certificate chain

I don't know if that's a step in the right direction or not. My understanding is that a CA's public cert is a self-signed cert, but how to get rid of the error?

share|improve this question
up vote 2 down vote accepted

It's a client issue.

c_rehash /etc/ssl/certs/
openssl s_client -CApath /etc/ssl/certs -connect


openssl s_client -CAfile /path/to/rootca.pem -connect
share|improve this answer
Thanks, that solved the problem. – Nick Feb 2 '12 at 19:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.