I have requested a new class 1 server certificate from StartSSL today and it is working great with Apache and Dovecot + (Thunderbird/Outlook/OpenXChange ), but when I try to connect to the mail server using an Apple client (Mac/iPhone), I get an SSL error message.

I have chained the

  • 2_Server Certificate
  • 1_Intermediate Certificate
  • Root Certificate

in this order and used the resulting file as ssl_cert in dovecot. The only other two SSL settings I have are ssl=required and ssl_key = </path

Has anybody had this issue before and came up with a solution?


Your problem is your CA: StartSSL.

Their certificates are nothing but a waste of electrons since this year, because Apple, Google and Mozilla don't trust them anymore out of the box and for sure others will follow.


  • 10
    So something like letsencrypt.org would be a better substitute, despite their certs being limited to 90 days.
    – Criggie
    Jan 30 '17 at 2:11
  • 14
    @Max Let's Encrypt is quite unlikely to engage in the sort of fraud we saw out of StartCom/WoSign. Jan 30 '17 at 3:07
  • 15
    @DepressedDaniel LE has every indication of operating as a reputable, positive actor. StartSSL was problematic for years before getting caught, including stuff like charging for Heartbleed revocations. It's entirely possible to assign likelihoods.
    – ceejayoz
    Jan 30 '17 at 3:24
  • 5
    @Ángel Old StartSSL, you mean? Fraud started under WoSign. Shitty practices like charging for the Heartbleed revocations were before that, though. (Heartbleed hit in 2014; WoSign secretly bought them in 2015)
    – ceejayoz
    Jan 30 '17 at 12:57
  • 3
    We are staying off topic a bit, but... The charging for heartbleed revocations is quite different: bad in terms of customer care but not a breach of anything (when you sign up the cost of revocations isn't actively hidden and heartbleed wasn't any fault of StartSSLs). The more recent behaviour that resulted in action by the browser makers was a breach (or multiple breaches) of the trust model of SSL Jan 30 '17 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.