Google Apps Email migration; Fatal error: tls_start_servertls() failed

Question

HI,
I am piloting/evaluating a Google apps account at the request of one department and have hit a snag with email migration. Hoping someone here as performed a migration before and might be able to help.
My source is a 10.5.8 mail server and the only real modification to it has been the spam prevention techniques recommended by the fine folks over at topicdesk (works great). In any case, during the google migration API. it requests the following (and i place my entries next to it):
name: server
server software: cyrus
host: I input FQDN of server
security (the choices are SSL or STARTTLS, i use STARTTLS)
port: I input 993
That’s it and then I proceed. It asks for user credentials which I provide (and know are correct).
If I select STARTTLS, it errors out and in my mail logs (set to information), I see this:
Jan 15 13:28:01 host imaps[30911]: imaps TLS negotiation failed: mail-pz0-f30.google.com [209.85.222.30]
Jan 15 13:28:01 host imaps[30911]: Fatal error: tlsstartservertls() failed
If I use SSL (instead of STARTTLS) from the google API, it just silently fails on the mail server (nothing in the logs) and on the google side, it says unable to auth user name but it obviously isn’t even hitting the server when I use SSL since the mail logs do not show failed login attempts when using only SSL on the google migrator API.
So, I am choosing to attack the STARTTLS angle of this...
The local mail clients all can connect fine and they ARE using TLS as made evident here:
Jan 15 13:30:11 host imaps[31304]: login: client [xxx.xxx.xxx.xx] user CRAM-MD5+TLS User logged in
I experience no issues with STARTTLS from apple mail / thunderbird, etc. Only from the Google migrator API so the:
imaps TLS negotiation failed
Fatal error: tlsstartservertls() failed
seems odd to me in that I recall this issue long ago and it was related to TLS not starting but that obviously isn’t the case here since my other TLS clients are connecting to CYRUS using TLS.
Any ideas? Migrating the users via an IMAP client like mail will be a pain if this migrator tool doesn’t work
here’s my imapd.conf just in case:
admins: cyrusimap, postmaster, imapadmin
configdirectory: /Volumes/Vault/Mail/Database
partition-default: /Volumes/Vault/Mail/Store
unixhierarchysep: yes
altnamespace: yes
servername: host FQDN
sievedir: /usr/sieve
sendmail: /usr/sbin/sendmail
lmtpdowncasercpt: 1
unixgroupenable: 0
berkeleytxnsmax: 400
berkeleylocksmax: 20000
berkeley_cachesize: 8192
berkeleymax_logregion: 2048
berkeleymax_logfile: 10240
berkeleymax_logbuffer: 2048
tlskeyfile: /etc/certificates/hostfqdn.key
quotawarn_frequencydays: 1
tlscertfile: /etc/certificates/hostfqdn.crt
enablequotawarnings: yes
imapauth_crammd5: yes
logrolling_daysenabled: 0
logrollingdays: 1
tlscafile: /etc/certificates/hostfqdn.chcrt
tlsserveroptions: require
popauthclear: no
imapauthclear: no
enable_pop: no
quotawarn: 80
enable_sieve: 0
imapauthgssapi: yes
popauthgssapi: yes

Answer 1

Well, setting tls to “use” instead of require did not help. Same behavior:
Selecting “SSL” with port 993 in google migrator tool immediately invokes the error:
Failed to authenticate IMAP username: user (I have tried a few users and verified name / password). The mail logs also show nothing so I don’t think SSL can work in a 10.5.x setup since TLS is involved since it seems it never even hits the server at all using this method.
Selecting “STARTTLS” with port 993 in google migrator shows a:
“failed to contact imap server” mail logs continue to show: Jan 25 10:28:21 host imaps[89058]: imaps TLS negotiation failed: mail-pz0-f3.google.com [209.85.222.3]
I’m sure it would work if I enabled IMAP in the clear (hence disabling IMAP SSL completely) but that isn’t going to happen for obvious reasons.
I’ll try contacting google and see if they have any suggestions :X