Wednesday, November 18, 2009

SugarCRM + IMAP + SSL Problems?

Been away from the blog for a few days.  Busy building some cool tools and others to come.. ;)

Anyway, here is an interesting tidbit which may help save you some headaches when using the SugarCRM e-mail client.
IMAP based e-mail accounts that require the use of SSL have a tendency to cause problems within SugarCRM's e-mail client.  In fairness, the majority of these problems are usually the result of one of the following:

  1. Connectivity issues (e.g. firewalls)
  2. PHP Configuration

Where SugarCRM could benefit is within the area where the e-mail settings are validated and tested.  SugarCRM does not check for potential problems with either of those potential traps and it tends to complicate the troubleshooting process.  Let's take a more in-depth look at one of these situations and hopefully save ourselves some future hair pulling.

One of the more common scenarios pertains to the inability to connect to an IMAP server that requires SSL via SugarCRM, although attempts at doing so via other applications, e.g. Microsoft Outlook, are successful.

The first step in troubleshooting this problem is to ensure that IMAP has been enabled within your PHP install.  Assuming it is, verify that SSL is enabled.  Assuming it is, one should see an entry that reads SSL Support => Enabled within the output of the PHP configuration.

Now, one would naturally assume that having these two items in place would be sufficient to make things work.  Unfortunately, multiple servers I've encountered would prove otherwise.

Upon further analysis on the differences between the working and non-working PHP installations on the servers involved, it became apparent that Kerberos support also needed to be enabled as part of the IMAP extension in order for the functionality to work.

Please note that this is not a problem with SugarCRM, i.e. it is not a bug.  Any PHP script using the IMAP extension (c-client) would and does experience the same problem as the SugarCRM e-mail client.

Hope this helps save you some troubleshooting time.


  1. Note that there are additional problems where the underlying database is being incorrectly updated, so that while one appears to be connecting via the method that does work (::::ssl::imap::novalidate-cert::notls::) the actual entr is different (:::::imap:::::). In general, the number of bugs I have encountered in attempting to an imap only version (5.5.5) is truly staggering.

  2. I've never looked at that end of it that closely to comment, but out of curiosity, do you know if these issues have been fixed in 6.x?

    If not, do you know if they have been submitted as bugs?

  3. Thanks for the helpful tools Angel. I'm working to enable email in an implementation of Info@Hand and encountered the exact issues you've outlined with IMAP and SMTP. The frustrating thing is that I have seemingly have both SSL and Kerberos enabled but the test_imap returns an error.

    How else can I trouble shoot this issue?


    IMAP c-Client Version 2007e
    SSL Support enabled
    Kerberos Support enabled

  4. @pw:

    If test_imap.php script returns an error, there is definitely an issue with the environment, as that script doesn't rely on any Sugar code.

    Have you tried using telnet to manually connect to the server? (assuming you have shell/console access)

  5. Angel:
    I'm currently working with SugarCRM to try and enable Group Inbound Emails so we can create cases from incoming emails, but I'm encountering an issue: Personal email works fine, but Group Email does not. Error log shows that connecting to the gmail server where the company's email is hosted times out. Allow me to clarify for a moment:
    Our Email system is hosted entirely through Gmail
    (, and all associated groups) And we've been looking at SugarCRM to replace JIRA/Confluence as our CRM system.
    I've ensured SSL is installed (openSSL is installed and enabled according to phpinfo()) but Imap is not mentioned in the output of phpinfo(). What makes no sense though, is that personal email works entirely (which is useless to us as we need to be able to create cases from emails to our support box) Sugar Tells me the connection test is successful, using both POP3 and IMAP, but then no emails will be imported, and the error log shows the same "Cannot connect to, connection timed out" etc, etc. I've been trawling through forums, even, in desperation, tried to setup an IMAP proxy. What am I doing wrong? Am I going to have to recompile PHP from scratch to allow IMAP support?
    Best Regards,

  6. You definitely need the IMAP libraries. If it is not showing up in phpinfo(), there is a problem. I don't know what odd behavior might happen if you don't have it, but I can't see it working properly.

    Have you tried using the test script here (to verify the system can connect):

  7. running said scripts returns the following:
    Could not connect: Unable to negotiate TLS with this server
    I've gone ahead and installed the IMAP libraries, and it still returns:
    Could not connect: Unable to negotiate TLS with this server

  8. @Ian:

    Have you confirmed that TLS is available on the server you are connecting to?

    From what I've read about that error, it usually comes up when the mail server in question does not actually support TLS for the communication.

  9. TLS is available, I discovered the source of that issue, and Sugar connects properly now. However, I still cannot view any group emails. I'm at a loss here, I have no clue why it is not importing group emails. Or rather, it IS, because the debug log shows it connecting and retrieving emails, but I cannot view them in the application at all. I have a sneaking suspicion that it may have something to do with there not being Teams in SugarCRM CE 6.3 (the version we're running), but I really haven't the slightest clue.

  10. Not sure to be honest. I can't see how it would be related to teams though, as the group email feature isn't limited to the commercial editions of Sugar.

    Have you looked in the emails and emails_text tables to confirm that the messages are indeed making it into the database?

  11. I am having the same issues as Ian. Personal emails work fine, but Group emails not importing. I did a fresh install of sugarCRM as a benchmark and I could get the personal emails to work, but not the group emails.

    1. This is always a bit of a tricky issue. I've had some folks report to me that switching the Group Email account to POP3 does the trick. However, that also means you would be using an unsupported protocol, as POP3 is no longer officially supported by Sugar. Despite that, I think it is worth the risk and I can't recall a situation where someone later came back and said they were having a problem that could be directly attributed to POP3.


Your comments, feedback and suggestions are welcome, but please refrain from using offensive language and/or berating others. Thank you in advance.