Fixing the Courier and Exim SSL certificates

Most hosting accounts come with cPanel, and by implication Exim and Courier under the hood. Some people access their mail using the cPanel webmail interface (usually via https://example.com:2096), but if you need to send more than the occasional e-mail, you probably want to set up Outlook or Thunderbird to connect to the IMAP server.

Sometimes, the hosting company won't have a canonical host name and matching SSL certificate for your domain, which will lead to endless security warnings in Thunderbird. If you've got shared hosting, there's not much you can do (short of opening a support ticker and hoping for the best), but if you are a VPS customer, here's how to fix your problem: first, edit /usr/lib/courier-imap/etc/imapd.cnf (in particular, set the correct hostname in the CN=... line). Then, run Courier's mkimapdcert. This will generate the file /usr/lib/courier-imap/share/imapd.pem, which combines a key and certificate and is used by the Courier IMAP server. Next, copy and paste the RSA private key (including the delimiter lines) from the PEM file to /etc/exim.key, and similarly the certificate (the second section in the PEM file) to /etc/exim.crt.

When you start Thunderbird, it will complain that it can't verify the certificate (to avoid this you'd have to pay a Certificate Authority like Verisign or Thawte, but we're not doing that today). Choose to accept the certificate permanently. VoilĂ , no more warnings.

Tags: