Self-signed SSL certificate not accepted

I’m running my own dovecot IMAP server and I’m accessing it with K-9 Mail 6.202 on two different Android phones. The old one is running Android 8.1.0, the new one has Android 12. The IMAP server uses a self-signed SSL certificate. On the old phone, this apparently is no problem; it may be I’ve had to accept the certificate once a long time ago.

On the new phone, I cannot get the email account to work. When I create the account, I enter the servername of the IMAP server, and manually configure all necessary parameters. Clicking “Next”, (“Weiter” in German), I get the error message the the server could not be connected. I can then finish the rest of the configuration dialog (for the smtp server, here I use the one of the commercial provider) and receive an email account about which K-9 mail does not complain and which I can use to send emails,
but not to receive any.

As the exact same setup is working on the one phone and is not on the other, I suspect the problem might be with Android, the newer version being more strict on which certificates are accepted. But this is just speculation.

I’d be grateful for any helpful hint on how to get my setup working. Thanks in advance!

Here is what I take as the relevant portion of the log file:

--------- beginning of main

[deleted 92 lines]

10-16 19:56:57.145 20396 29462 D RealImapConnection: Connecting to [edited:MYSERVERNAME] as [MYSERVERNAME/MYIP]
10-16 19:56:57.146 20396 29462 W com.fsck.k9: Accessing hidden method Lcom/android/org/conscrypt/ConscryptEngineSocket;->setHostname(Ljava/lang/String;)V (max-target-q,core-platform-api, reflection, denied)
10-16 19:56:57.146 20396 29462 W com.fsck.k9: Accessing hidden method Lcom/android/org/conscrypt/OpenSSLSocketImpl;->setHostname(Ljava/lang/String;)V (max-target-q,core-platform-api, reflection, denied)
10-16 19:56:57.146 20396 29462 W com.fsck.k9: Accessing hidden method Lcom/android/org/conscrypt/AbstractConscryptSocket;->setHostname(Ljava/lang/String;)V (max-target-q, reflection, denied)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: Could not call SSLSocket#setHostname(String) method
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: java.lang.NoSuchMethodException: com.android.org.conscrypt.Java8EngineSocket.setHostname [class java.lang.String]
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at java.lang.Class.getMethod(Class.java:2103)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at java.lang.Class.getMethod(Class.java:1724)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.helper.DefaultTrustedSocketFactory.setHostnameViaReflection(DefaultTrustedSocketFactory.java:160)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.helper.DefaultTrustedSocketFactory.setSniHost(DefaultTrustedSocketFactory.java:154)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.helper.DefaultTrustedSocketFactory.createSocket(DefaultTrustedSocketFactory.java:135)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.mail.store.imap.RealImapConnection.connectToAddress(RealImapConnection.java:236)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.mail.store.imap.RealImapConnection.connect(RealImapConnection.java:211)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.mail.store.imap.RealImapConnection.open(RealImapConnection.java:132)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.mail.store.imap.RealImapStore.checkSettings(RealImapStore.java:262)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.backend.imap.ImapBackend.checkIncomingServerSettings(ImapBackend.kt:149)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.controller.MessagingController.checkIncomingServerSettings(MessagingController.java:1740)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.checkIncoming(AccountSetupCheckSettings.kt:465)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.checkServerSettings(AccountSetupCheckSettings.kt:445)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.doInBackground(AccountSetupCheckSettings.kt:408)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.doInBackground(AccountSetupCheckSettings.kt:393)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at android.os.AsyncTask$3.call(AsyncTask.java:394)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at java.util.concurrent.FutureTask.run(FutureTask.java:266)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
10-16 19:56:57.147 20396 29462 E DefaultTrustedSocketFactory: at java.lang.Thread.run(Thread.java:920)
10-16 19:56:57.205 20396 29462 W RealImapConnection: Could not connect to [MYSERVER/MYIP]
10-16 19:56:57.205 20396 29462 W RealImapConnection: java.net.ConnectException: failed to connect to [MYSERVER/MYIP] (port 993) from /192.168.1.112 (port 38834) after 30000ms: isConnected failed: ECONNREFUSED (Connection refused)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at libcore.io.IoBridge.isConnected(IoBridge.java:349)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at libcore.io.IoBridge.connectErrno(IoBridge.java:238)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at libcore.io.IoBridge.connect(IoBridge.java:180)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.net.PlainSocketImpl.socketConnect(PlainSocketImpl.java:142)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:390)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:230)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:212)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:436)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.net.Socket.connect(Socket.java:621)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.android.org.conscrypt.AbstractConscryptSocket.connect(AbstractConscryptSocket.java:156)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.mail.store.imap.RealImapConnection.connectToAddress(RealImapConnection.java:241)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.mail.store.imap.RealImapConnection.connect(RealImapConnection.java:211)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.mail.store.imap.RealImapConnection.open(RealImapConnection.java:132)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.mail.store.imap.RealImapStore.checkSettings(RealImapStore.java:262)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.backend.imap.ImapBackend.checkIncomingServerSettings(ImapBackend.kt:149)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.controller.MessagingController.checkIncomingServerSettings(MessagingController.java:1740)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.checkIncoming(AccountSetupCheckSettings.kt:465)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.checkServerSettings(AccountSetupCheckSettings.kt:445)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.doInBackground(AccountSetupCheckSettings.kt:408)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.doInBackground(AccountSetupCheckSettings.kt:393)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at android.os.AsyncTask$3.call(AsyncTask.java:394)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.util.concurrent.FutureTask.run(FutureTask.java:266)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at java.lang.Thread.run(Thread.java:920)
10-16 19:56:57.205 20396 29462 W RealImapConnection: Caused by: android.system.ErrnoException: isConnected failed: ECONNREFUSED (Connection refused)
10-16 19:56:57.205 20396 29462 W RealImapConnection: at libcore.io.IoBridge.isConnected(IoBridge.java:336)
10-16 19:56:57.205 20396 29462 W RealImapConnection: … 24 more
10-16 19:56:57.205 20396 29462 E RealImapConnection: Failed to login, closing connection for %s
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: Error while testing settings
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: com.fsck.k9.mail.MessagingException: Cannot connect to host
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.mail.store.imap.RealImapConnection.connect(RealImapConnection.java:218)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.mail.store.imap.RealImapConnection.open(RealImapConnection.java:132)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.mail.store.imap.RealImapStore.checkSettings(RealImapStore.java:262)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.backend.imap.ImapBackend.checkIncomingServerSettings(ImapBackend.kt:149)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.controller.MessagingController.checkIncomingServerSettings(MessagingController.java:1740)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.checkIncoming(AccountSetupCheckSettings.kt:465)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.checkServerSettings(AccountSetupCheckSettings.kt:445)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.doInBackground(AccountSetupCheckSettings.kt:408)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.activity.setup.AccountSetupCheckSettings$CheckAccountTask.doInBackground(AccountSetupCheckSettings.kt:393)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at android.os.AsyncTask$3.call(AsyncTask.java:394)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.util.concurrent.FutureTask.run(FutureTask.java:266)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.lang.Thread.run(Thread.java:920)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: Caused by: java.net.ConnectException: failed to connect to [MYSERVERNAME/MYIP] (port 993) from /192.168.1.112 (port 38834) after 30000ms: isConnected failed: ECONNREFUSED (Connection refused)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at libcore.io.IoBridge.isConnected(IoBridge.java:349)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at libcore.io.IoBridge.connectErrno(IoBridge.java:238)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at libcore.io.IoBridge.connect(IoBridge.java:180)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.net.PlainSocketImpl.socketConnect(PlainSocketImpl.java:142)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:390)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:230)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:212)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:436)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at java.net.Socket.connect(Socket.java:621)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.android.org.conscrypt.AbstractConscryptSocket.connect(AbstractConscryptSocket.java:156)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.mail.store.imap.RealImapConnection.connectToAddress(RealImapConnection.java:241)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at com.fsck.k9.mail.store.imap.RealImapConnection.connect(RealImapConnection.java:211)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: … 13 more
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: Caused by: android.system.ErrnoException: isConnected failed: ECONNREFUSED (Connection refused)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: at libcore.io.IoBridge.isConnected(IoBridge.java:336)
10-16 19:56:57.205 20396 29462 E AccountSetupCheckSettings$CheckAccountTask: … 24 more

The problem isn’t the certificate. It’s that your server doesn’t accept the client’s connection on port 993.