After upgrading my iPhone 6+ from iOS 8 to iOS 9, my IMAP email account stopped working. When the Mail app tries to connect to the server, it fails and displays an alert with the title "Cannot get Mail" and the message "The mail server x.y.z is not responding. Verify that you have entered the correct account info in Mail settings.".
I did check the account info, and it is indeed correct. Interestingly, I do not get any error messages from the settings app when I try to save the account. I have tried entering wrong information on purpose (wrong username, wrong password, wrong TCP port), and whenever I do that and try to save the account, the settings app shows an alert "The IMAP server x.y.z is not responding.". So I am really sure that the information I have entered is correct.
Moreover, I have two other iOS devices in the household (an iPad 2 and an iPhone 4S) which are configured to use the same account and which are still on iOS 8 - from these devices the account works properly, so I also know that the problem is not something basic like the IMAP server is down.
I have tried various things (see below), but without success. The only thing I know for certain is that the problem is somehow connected to TLS and/or certificates. Taking into account the information from this AskDifferent question I suspect it's a problem with the CAcert certificate, but I am not sure.
Do you know anything about changes in iOS 9 regarding the handling of certificates (untrusted or otherwise)? Or do you have other clues that might help me solve this problem?
Information about the server:
- The IMAP server runs on a Debian machine over which I have full control
- The IMAP server is Courier IMAP
- The IMAP server accepts connections on the standard IMAP port 143
- The IMAP server requires STARTTLS to enforce that all traffic is encrypted via TLS
- The IMAP server uses a wildcard certificate
- The IMAP server provides the whole certificate chain to the client
- The root CA is CAcert.org (link to root and intermediate CA certificates)
- Because CAcert.org is not, by default, in the trusted CA store of iOS 9, I have manually installed the root and intermediate CA certificates on the iPhone 6+
- Courier version = 0.73.1 (
- OpenSSL version = 1.0.2d (
What have I tried?
- The first thing I did is, I deleted the entire account configuration in the iPhone's settings app, then created a new account and re-entered the configuration details. No success.
- I upgraded various packages on the Debian machine, including Courier and OpenSSL, to make sure that the server has the "latest and greatest" security capabilities. No success.
- I read somewhere that iOS 9 might require TLS 1.2 on the server side, so I double-checked that the IMAP server indeed offers that version of TLS to its clients. It does. This is the command I used for verification:
openssl s_client -connect mail.herzbube.ch:143 -starttls imap. If you run this you will see a block with information about the SSL session towards the end, this block contains a line that shows the TLS version that is used (
Protocol : TLSv1.2). Note that in order to get TLS v1.2, your client-side version of OpenSSL must also support this. For instance, OpenSSL on my Mac OS X Yosemite (10.10.3) laptop is too old, i.e. it is only version 0.9.8.zd and does not seem to understand TLS 1.2, so I get
Protocol : TLSv1.
- I deleted the CAcert root and intermediate certificates on the iPhone, then re-installed them. Nope, didn't help.
- I temporarily disabled the requirement for TLS on the server-side, and this solves the issue, i.e. now the Mail app can connect, login and get emails from the server. Obviously this is not a real solution, since I don't want the traffic to the IMAP server to be in clear-text, but at least now I know that the problem is somehow connected to TLS (and/or certificates).
- I updated the iPhone to iOS 9.0.1. No success.