IMAP not working after Renewing the SSL certificates

[biozins]

Hi,

I needed to renew the SSL Certificate. I followed the steps here

Renewing the SSL certificates

Communication between the different systems in a UCS domain is largely SSL encrypted. A root certificate and host certificate for each computer are required for the SSL encryption. The root certificate is only valid for a specified period of time, as are the host certificates created with the root certificate. Once this period of time elapses, services which encrypt their communication with SSL (e.g., LDAP) no longer function. It is thus essential to verify the validity of the certificates and c…

After restart IMAP Login (dovecot) is not working with the following error

 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.8.158, lip=192.168.8.12, TLS: SSL_read() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48,
session=<7sP0y1e2jdfAqAie>

Seams like dovecot can not find the rootCA. Any hints what I can do to make dovecot and my users happy?
Thanks in advance
Klaus

[Mornsgrans]

Check name and location of the new root certificate and compare it via browser-login with the entries in System - Univention Configuration Registry

On my System with Kopano instead of Dovecot i found the CA in
/etc/univention/ssl/ucsCA/CAcert.pem

Did you restart/reload Apache, Postfix and Dovecot after retrieving the new CA?