Unable to log in to Roundcube webmail after upgrade to Plesk Onyx 17.8: Connection to storage server failed

Symptoms

• Plesk was upgraded from Onyx 17.5 to Onyx 17.8. As result it is not possible to log in to Roundcube Webmail at http://webmail.example.com, the following error appears in Roudcube UI:

  CONFIG_TEXT: Connection to storage server failed

• Dovecot is used as IMAP server.

• The following errors can be found in the file /var/log/plesk-roundcube/errors:

  CONFIG_TEXT: PHP Warning: stream_socket_client(): Failed to enable crypto in /usr/share/psa-roundcube/program/lib/Roundcube/rcube_imap_generic.php on line 959
  PHP Warning: stream_socket_client(): unable to connect to ssl://localhost:993 (Unknown error) in /usr/share/psa-roundcube/program/lib/Roundcube/rcube_imap_generic.php on line 959
  IMAP Error: Login failed for john.doe@example.com from 203.0.113.2(X-Real-IP: 203.0.113.2). Could not connect to ssl://localhost:993: Unknown reason in /usr/share/psa-roundcube/program/lib/Roundcube/rcube_imap.php on line 196 (POST /?_task=login&_action=login)

• Or the following error is present in the file /var/log/plesk-roundcube/errors:

  CONFIG_TEXT: stream_socket_enable_crypto(): SSL operation failed with code 1.
  OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in /usr/share/psa-roundcube/vendor/pear/net_sieve/Sieve.php on line 1239
  ERROR: Failed to establish TLS connection (2)
  <htjlo6fq> PHP Error: Unable to connect to managesieve on localhost:4190 in /usr/share/psa-roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 222 (GET /?_task=settings&_action=plugin.managesieve)
  ERROR: Not currently in AUTHORISATION state (1)
  ERROR: Failed to read from socket ()

• The following errors may appear in /var/log/maillog

  CONFIG_TEXT: dovecot: managesieve-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=::1, lip=::1, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<xxxxxxxxxxxxAAAAAAAAAAAAAAAAAAAAB> * From Roundcube > Configuration > Filter > an error occurs "Can not connect o Managesieve server"

• The mail server is secured with an SSL certificate in Tools & Settings > SSL/TLS Certificates > Certificate for securing mail.

Cause

This is the Plesk bug PPPM-8078. It was fixed in Plesk Onyx 17.8.11 MU3.

Resolution

Consider updating Plesk to 17.8.11 MU3.

If the update is not possible, the following workaround can be used:

1. Connect to the server using SSH.

2. Backup the configuration files config.inc.php and config.inc.php :

   # cp -a /usr/share/psa-roundcube/config/config.inc.php /root/old_config.inc.php
   # cp -a /usr/share/psa-roundcube/plugins/managesieve/config.inc.php /root/old_config.inc.php

3. In the file /usr/share/psa-roundcube/config/config.inc.php set the value of the parameter verify_peer and verify_peer_name to false and allow_self_signed to true in $config\['imap_conn_options']" and in "$config['smtp_conn_options']"sections:

   CONFIG_TEXT: $config['imap_conn_options']
   ...
   'verify_peer' => false,
   'verify_peer_name' => false,
   'allow_self_signed' => true,

   CONFIG_TEXT: $config['smtp_conn_options'] = array(
   'ssl' => array(
   'verify_peer' => false,
   'verify_peer_name' => false,
   'allow_self_signed' => true,

4. Set verify_peer and verify_peer_name to false and allow_self_signed to true in /usr/share/psa-roundcube/plugins/managesieve/config.inc.php

   CONFIG_TEXT: config['managesieve_conn_options'] = array(
   'ssl' => array(
   'verify_peer' => false
   'verify_peer_name' => false,
   'allow_self_signed' => true