Start/notes.ini Parameters/POP3DebugSSL

POP3DebugSSL

Parameter: POP3DebugSSL
Short description: Enables SSL/TLS debug logging for the Domino POP3 task. Diagnoses STARTTLS/TLS handshakes and certificate issues for POP3S and STARTTLS connections.

Profile

Parameter
POP3DebugSSL
Component
Server (POP3 task)
Category
Logging / Debug
Available since
9.0.x (per KB0029557)
Default
0 (disabled)
Values
0 off, 1 on
Prerequisite for visibility
Console log must be active

Description

POP3DebugSSL is the POP3 counterpart to SMTPDebugSSL and IMAPDebugSSL. When set to 1, for every incoming or outgoing SSL/TLS session the POP3 task writes TLS-specific diagnostic entries to the Domino log. This includes:
  • The STARTTLS command and the peer's response (with explicit STARTTLS negotiation),
  • Direct TLS negotiation on the POP3S port (typically 995/TCP),
  • The negotiated TLS protocol version and cipher suite,
  • Certificate verification (trust, expiry, site certificate),
  • Handshake phases and any error codes from the SSL layer.

Examples

POP3DebugSSL=1
Dynamically at runtime:
set config POP3DebugSSL=1
tell pop3 quit
load pop3
Disable:
set config POP3DebugSSL=0
tell pop3 quit
load pop3

Notes

  • Enable the console log — KB0029557 explicitly notes: "The console log must be enabled to view output from the above debugging parameters."
  • Spelling — In HCL KB0029557, the spelling is documented as POP3Debugssl=1 with lowercase; since notes.ini is case-insensitive, both variants work the same.
  • Companion parameters —
    • SMTPDebugSSL=1 for the SMTP task,
    • IMAPDebugSSL=1 for the IMAP task,
    • DEBUG_SSL_HANDSHAKE=2/DEBUG_SSL_CIPHERS=2 as a generic counterpart for all TLS-capable Domino tasks (HCL Wiki, Daniel Nashed).
  • Performance — Under heavy POP3 load, the logging produces a lot of output; only enable during diagnostic reproduction.
  • Privacy — Mail body and content are not captured (POP3DebugSSL is restricted to the TLS layer). Connection metadata (addresses, certificate subjects) may, however, be personally identifiable.
  • Counterpart at the content level — For the POP3 protocol level or bytes, logging is done via the server console (tell pop3 debug ...) or domain-specific debug switches.

Sources (HCL Product Documentation)