TLS server engine: cannot load CA data

Why are you trying to connect to webmail over port 995?
995 is to be used by a POP client for a secure connection. IMAP would be 993, but again for a connection by an IMAP client. In other words, webmail will use 993 to connect to the IMAP server (if setup properly).

However the user should still connect via port 80 (or 443 for website SSL) to webmail.

What you are doing is trying to connect with a web browser to an POP server. Will not work (unless you have changed all your ports, which would not be a good idea).

Alex

Good point. In my haste, I typed the wrong port
number. Everything above still applies but with a
connection on port 993.

Even so, we are talking different protocols here.
Use a client or telnet to test.

Trying to do this directly to see if the connection
works before redirecting webmail to 993 from 443
website SSL currently being used.

Webmail should not be redirected!
Browser-Port443-SquirrelMail-Port993-IMAP server.

Besides if Squirrelmail and Cyrus are on the same server, using SSL from squirrelmail to IMAP is pointless as there is no network traffic. It only makes sense for IMAP clients that connect over a network.

I imagine that this TLS issue can be ignored then
since it does not affect operation of POP clients
connecting or webmail clients connecting in their
usual way?

Probably just generated by using the wrong protocol on the wrong port.
Once you have properly setup your clients and server and the problem persists, we'll take it from there.

Alex

I'm experiencing the same problem and really need a solution. The situation: looking to get secure imap up, we're open on port 993

$ netstat -an | egrep "\*.993"
tcp4 0 0 *.993 . LISTEN
tcp6 0 0 *.993 . LISTEN

and we've got cyrus waiting for connections:

$ lsof -i | egrep imaps
master 5961 cyrusimap 14u IPv6 0x360ad1c 0t0 TCP *:imaps (LISTEN)
master 5961 cyrusimap 17u IPv4 0x3b6a018 0t0 TCP *:imaps (LISTEN)

we've got a self-signed certificate created in Server Admin, and also via SA, we direct the mail service to use that certificate (i.e., the tls certfile and tls keyfile entries in /etc/imapd.conf are pointing the corresponding entries in /etc/certificates). But then: attempts to connect via a client (Mail.app) generate the following in /var/log/mailaccess.log:

Jan 1 23:38:18 tamarama master[5968]: about to exec /usr/bin/cyrus/bin/imapd
Jan 1 23:38:18 tamarama imaps[5968]: executed
Jan 1 23:38:18 tamarama imaps[5968]: accepted connection
Jan 1 23:38:18 tamarama imaps[5968]: TLS server engine: cannot load CA data
Jan 1 23:38:18 tamarama imaps[5968]: imaps TLS negotiation failed: XXX.stanford.edu [171.66.XXX.XXX]
Jan 1 23:38:18 tamarama imaps[5968]: Fatal error: tls startservertls() failed
Jan 1 23:38:18 tamarama imaps[5968]: AOD: user opts: cleaning up user options structure
Jan 1 23:38:18 tamarama master[5961]: process 5968 exited, status 75