The Windows 8 Mail ‘app’ is fussy about who it will talk to, and gives absolutely no clues about what it thinks is wrong. It just refers the user to their system administrator.
But, with help from Eric Lee Green’s blog, I finally cracked it.
I have a Debian server running Exim4 (for SMTP) and Dovecot (IMAP).
Firstly I needed up-to-date self-signed SSL certificates for each of these (which I should have had anyway, but email clients such as Thunderbird are much less fussy).
For Exim, that means running
# bash /usr/share/doc/exim4-base/examples/exim-gencert
Debian hides the certificate-generating script for Dovecot in the .deb package, so you have to run
# rm /etc/dovecot/dovecot.pem # rm /etc/dovecot/private/dovecot.pem # dpkg-reconfigure dovecot-core
The next operation is to get the public certificate files (not the ones in private directories, obviously), i.e. exim.crt and dovecot.pem onto the Windows 8 machine. I used psftp to copy them to the desktop. Rename dovecot.pem to dovecot.crt so that Windows knows what to do with it. Then, for each one in turn:
- right-click on it, and choose ‘Install Certificate’
- choose ‘Current User’ (unless you know better), and click on ‘Next’
- choose ‘Place all certifcates in the following store’, and browse to select ‘Trusted Root Certification Authorities’.
- click on ‘Next’, then ‘Finish’. It will ask if you’re sure — it’s up to you to be sure that you’ve got the right certificate.
Finally the Mail app should now let you set up an account. Make sure that the server names you use match the ones in the certificate. To check, run this (back on Debian):
# openssl x509 -in /etc/exim4/exim.crt -text -noout # openssl x509 -in /etc/dovecot/dovecot.pem -text -noout
and examine the output.
A final note: W8 Mail, being the half-baked toy that it is, doesn’t offer STARTTLS as a connection option, only the ‘obsolete’ (according to Hazel) SSMTP protocol — what the app refers to as simply ‘SSL’. So you’ll have to set up Exim to do that.
Trying to do SSL on port 587 (i.e. expecting STARTTLS), I get:
2013-12-15 12:42:47 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=example.org.uk [1.2.3.4] input="\026\003\00 2013-12-15 12:42:47 TLS error on connection from example.org.uk [1.2.3.4] (recv): A TLS packet with unexpected length was received. 2013-12-15 12:42:47 TLS error on connection from example.org.uk [1.2.3.4] (send): The specified session has been invalidated for some reason.
even after applying the alleged fix at https://bugs.launchpad.net/ubuntu/+source/gnutls13/+bug/1007231.