# Dovecot SSL Cert Problem

**URL:** <https://discourse.haproxy.org/t/dovecot-ssl-cert-problem/1199>\
**Category:** Help!\
**Created:** [April 28, 2017, 7:49pm UTC](https://discourse.haproxy.org/t/dovecot-ssl-cert-problem/1199 "2017-04-28T19:49:05Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 28, 2017, 9:42pm UTC](https://discourse.haproxy.org/t/dovecot-ssl-cert-problem/1199/2 "2017-04-28T21:42:55Z")

</div>

Do you want Haproxy to handle SSL and connect to the backend in cleartext (no SSL)?

Then you need to use the ssl keyword on the frontend, and a cleartext destination port on the backend.

Please check the following 4 changes:

```
**frontend** webForward <-- this is a frontend section, not a listen section
        bind :443 ssl crt /etc/ssl/private/certprivkey.pem no-sslv3
        #mode tcp 
        reqadd X-Forwarded-Proto:\ https
        default_backend www-backend

backend www-backend
        redirect scheme https if !{ ssl_fc }
        #mode tcp
        balance roundrobin
        stick-table type ip size 200k expire 30m
        stick on src
        server s1 6x.xxx.xx.xxx: **80** <--- cleartext port 80 here

listen dovecot-imap
        bind :993 **ssl crt /etc/ssl/private/certprivkey.pem no-sslv3** <-- specify the ssl keyword, along with certificate configuration here
        mode tcp
        #option ssl-hello-chk
        option http-keep-alive
        balance first
        tcp-check connect port 993
        tcp-check expect string *\ OK
        stick-table type ip size 200k expire 15m
        stick on src
        timeout server 1m
        timeout connect 1m
        timeout client 5m
        server s1 10.0.0.1: **143** send-proxy-v2 <-- should be a cleartext port!
        server s2 10.0.0.2: **143** send-proxy-v2 <-- should be a cleartext port!
```

---

_[View the full topic](https://discourse.haproxy.org/t/dovecot-ssl-cert-problem/1199)._