\n\tThe Windows 8 Mail ‘app’ is fussy about who it will talk to, and gives absolutely no clues about what it thinks is wrong. It just refers the user to their system administrator.\n<\/p>\n
\n\tBut, with help from Eric Lee Green’s blog<\/a>, I finally cracked it.\n<\/p>\n \n\tI have a Debian server running Exim4 (for SMTP) and Dovecot (IMAP).\n<\/p>\n \n\tFirstly I needed up-to-date self-signed SSL certificates for each of these (which I should have had anyway, but email clients such as Thunderbird are much less fussy).\n<\/p>\n \n\tFor Exim, that means running\n<\/p>\n \n\tDebian hides the certificate-generating script for Dovecot in the .deb package, so you have to run\n<\/p>\n \n\tThe next operation is to get the public certificate files (not the ones in private directories, obviously), i.e. exim.crt and dovecot.pem onto the Windows 8 machine. I used psftp<\/a> to copy them to the desktop. Rename dovecot.pem to dovecot.crt so that Windows knows what to do with it. Then, for each one in turn:\n<\/p>\n \n\tFinally the Mail app should now let you set up an account. Make sure that the server names you use match the ones in the certificate. To check, run this (back on Debian):\n<\/p>\n \n\tand examine the output.\n<\/p>\n \n\tA final note: W8 Mail, being the half-baked toy that it is, doesn’t offer STARTTLS as a connection option, only the ‘obsolete’ (according to Hazel<\/a>) SSMTP protocol — what the app refers to as simply ‘SSL’. So you’ll have to set up Exim to do that.\n<\/p>\n \n\tTrying to do SSL on port 587 (i.e. expecting STARTTLS), I get:\n<\/p>\n\r\n# bash \/usr\/share\/doc\/exim4-base\/examples\/exim-gencert<\/pre>\n
\r\n# rm \/etc\/dovecot\/dovecot.pem\r\n# rm \/etc\/dovecot\/private\/dovecot.pem\r\n# dpkg-reconfigure dovecot-core<\/pre>\n
\n
\r\n# openssl x509 -in \/etc\/exim4\/exim.crt -text -noout\r\n# openssl x509 -in \/etc\/dovecot\/dovecot.pem -text -noout<\/pre>\n
\r\n2013-12-15 12:42:47 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=example.org.uk [1.2.3.4] input=\"\\026\\003\\00\r\n2013-12-15 12:42:47 TLS error on connection from example.org.uk [1.2.3.4] (recv): A TLS packet with unexpected length was received. \r\n2013-12-15 12:42:47 TLS error on connection from example.org.uk [1.2.3.4] (send): The specified session has been invalidated for some reason.<\/pre>\n