Add Thunderbird security exception for self-signed SSL certificate

3
votes

I have created a self-signed SSL certificate using OpenSSL, and I added it to hMailServer accessible in the private network. I used this certificate on port 465 and 993 to run SMTP and IMAP respectively with SSL:

Then I restarted the server and added inbound and outbound firewall rules to allow connection to the ports opened by hMailServer. But when I try to connect to my mail server with SSL from another computer in the local network, it fails:

I strongly suspect that it's because Thunderbird doesn't allow self-signed certificates by default, because when I switch the "SSL" value back to "Autodetect" it finds well the account settings, but only on "unencrypted" ports, i.e. 587 for SMTP and 143 for IMAP.

So now I want to add a security exception for my SSL certificate in Thunderbird in order to use it. I go to Thunderbird Preferences > Advanced > Certificates tab > Manage Certificates > Servers tab > Add exception and then type the IP and port of the SMTP (or IMAP) server that uses the SSL certificate, but it doesn't find it:

What did I do wrong? I followed this tutorial to add a new exception on Thunderbird. When I try to do openssl s_client -connect 192.168.1.15:465, I get a SSL certificate but it's not the same than the one I imported in hMailServer and I don't know if it's normal.

Thank you for your help.

1
sslopensslssl-certificatethunderbirdhmail-server

1 Answers

2
votes

I think it is because of a stupid bug on Thunderbird. If we add the security exception directly on the certificate manager of Thunderbird, clicking on the "Get Certificate" doesn't find the certificate.

How I got it working is by first connecting to a mail account on unencrypted ports (i.e. 587 for SMTP and 143 for IMAP):

Then, I switched the connection security in the account settings to "SSL/TLS" both for SMTP and IMAP:

Finally, I sent an email to a random recipient, and I got this alert:

I just clicked on the "Confirm security exception" button and it added the certificate correctly. What I was previously doing is to click on "Get Certificate" and it lost the certificate so I couldn't add it.