CE5.5.0 - Configure Mail Account SSL Error

[vstokesjr]

Sugar: 5.5.0 CE GA
Apache: 1.3.41
PHP: 5.2.5
MySQL: 5.0.81

We run an in house Microsoft Exchange Server using a self-generated SSL certificate. We would like to configure incoming email accounts in sugarCRM. However, whenever we attempt to add the settings we get the following error:

Test Settings
Certificate failure for XXX.DOMAIN.COM: unable to get local issuer certificate: /CN=XXXX
Please check your settings and try again.

Our devices (iPhones, Blackberry's, web browsers, etc) prompt for adding an SSL exception for the certificate. We have tried POP, POP/SSL, IMAP, IMAP/SSL and we always end up with the same result.

We cannot figure out how to get passed this error. Any help would be appreciated.

[ngaller]

We actually ran into this same issue today.

Sugar will try to log in without validating the certificate also, but it only prints the last error on the test screen, so you see that certificate error. If you look at the sugarcrm.log file you may see another error - in our case it was something to do with the kerberos settings. It seems to be an incompatibility between php and Exchange 2007.

The actual text of the error:
Tue Jan 5 12:03:30 2010 [19606][1][DEBUG] 7: I-E failed using [{mailserver:993/service=imap/ssl/notls/novalidate-cert/secure}INBOX] - error: Kerberos error: Credentials cache file '/tmp/krb5cc_33' not found (try running kinit) for ...

I could not find an easy way to get around it via the configuration of either php, sugar or Exchange, however recompiling the imap extension with the kerberos extension disabled resolved the issue.

The recompilation was a relatively straightforward process on my system (Linux Ubuntu):
apt-get build-dep libc-client2007b-dev
apt-get source libc-client2007b-dev
(edit configuration file under debian/rules to disable kerberos)
dpkg-buildpackage
(install the 2 resulting libc-client packages)

Then repeat the process for the php5-imap package.

Hope this helps.

[vstokesjr]

Nice.

However, I suspect most of us do not have this type of access. We are stuck with what the hosting service gives us.