From 2c19a63b9da87259c4df0dd798a0bb7d8303fcc0 Mon Sep 17 00:00:00 2001
From: Sebastian Spaeth <Sebastian@SSpaeth.de>
Date: Thu, 19 Jan 2012 10:08:31 +0100
Subject: [PATCH] DOCS: Add SSL debugging info to FAQ

Take the debugging instructions by Daniel Shahaf and add them to the
FAQ.

Signed-off-by: Sebastian Spaeth <Sebastian@SSpaeth.de>
---
 docs/FAQ.rst | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docs/FAQ.rst b/docs/FAQ.rst
index 29b53d6..4acad4e 100644
--- a/docs/FAQ.rst
+++ b/docs/FAQ.rst
@@ -302,6 +302,20 @@ The path `/etc/ssl/certs` is not standardized; your system may store
 SSL certificates elsewhere.  (On some systems it may be in
 `/usr/local/share/certs/`.)
 
+If this does not work and you are getting error messages, you can test the certificate using a command like (credits to Daniel Shahaf for this)::
+
+    % openssl s_client -CAfile $sslcacertfile -connect ${hostname}:imaps 2>&1 </dev/null
+    verify return:1
+    verify return:1
+(If you post the output, post the full output, without 'grep' filtering)
+
+    verify return:1
+        Verify return code: 0 (ok)
+
+If the server uses STARTTLS, pass the -starttls option and the 'imap' port.
+
+Also, you can test::
+  gnutls-cli --x509cafile certs/mail.mydomain.eu.cert -p 993 mail.mydomain.eu
 
 IMAP Server Notes
 =================