diff --git a/srcpkgs/dovecot/INSTALL b/srcpkgs/dovecot/INSTALL
new file mode 100644
index 00000000000..3c5ade70de6
--- /dev/null
+++ b/srcpkgs/dovecot/INSTALL
@@ -0,0 +1,9 @@
+case "${ACTION}" in
+post)
+	if [ -f etc/ssl/private/dovecot.pem -a -f etc/ssl/certs/dovecot.pem ]; then
+		exit 0
+	fi
+	echo "Creating self-signed certificate..."
+	usr/bin/dovecot-mkcert.sh
+	;;
+esac
diff --git a/srcpkgs/dovecot/INSTALL.msg b/srcpkgs/dovecot/INSTALL.msg
new file mode 100644
index 00000000000..2dc5444d4df
--- /dev/null
+++ b/srcpkgs/dovecot/INSTALL.msg
@@ -0,0 +1,6 @@
+A self-signed certificate for SSL has been created automatically, but
+this should be created again with proper settings in dovecot-openssl.cnf:
+
+	$ rm -f /etc/ssl/{certs,private}/dovecot.pem
+	$ [edit /etc/ssl/dovecot-openssl.cnf]
+	$ /usr/bin/dovecot-mkcert.sh
diff --git a/srcpkgs/dovecot/patches/openssl3.patch b/srcpkgs/dovecot/patches/openssl3.patch
new file mode 100644
index 00000000000..8f39a7ddfe2
--- /dev/null
+++ b/srcpkgs/dovecot/patches/openssl3.patch
@@ -0,0 +1,45 @@
+From: =?utf-8?q?Christian_G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Wed, 11 May 2022 20:27:53 +0200
+Author: Michal Hlavinka
+Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1962035
+Subject: Support openssl 3.0
+
+---
+ src/lib-dcrypt/dcrypt-openssl.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/src/lib-dcrypt/dcrypt-openssl.c b/src/lib-dcrypt/dcrypt-openssl.c
+index 1cbe352..5570d62 100644
+--- a/src/lib-dcrypt/dcrypt-openssl.c
++++ b/src/lib-dcrypt/dcrypt-openssl.c
+@@ -73,10 +73,30 @@
+   2<tab>key algo oid<tab>1<tab>symmetric algo name<tab>salt<tab>hash algo<tab>rounds<tab>E(RSA = i2d_PrivateKey, EC=Private Point)<tab>key id
+ **/
+ 
++#if OPENSSL_VERSION_MAJOR == 3
++static EC_KEY *EVP_PKEY_get0_EC_KEYv3(EVP_PKEY *key)
++{
++  EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key);
++  EVP_PKEY_set1_EC_KEY(key, eck);
++  EC_KEY_free(eck);
++  return eck;
++}
++
++static EC_KEY *EVP_PKEY_get1_EC_KEYv3(EVP_PKEY *key)
++{
++  EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key);
++  EVP_PKEY_set1_EC_KEY(key, eck);
++  return eck;
++}
++
++#define EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_EC_KEYv3 
++#define EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_EC_KEYv3
++#else
+ #ifndef HAVE_EVP_PKEY_get0
+ #define EVP_PKEY_get0_EC_KEY(x) x->pkey.ec
+ #define EVP_PKEY_get0_RSA(x) x->pkey.rsa
+ #endif
++#endif
+ 
+ #ifndef HAVE_OBJ_LENGTH
+ #define OBJ_length(o) ((o)->length)
diff --git a/srcpkgs/dovecot/template b/srcpkgs/dovecot/template
index 697788e5c26..9fcb7aaadf1 100644
--- a/srcpkgs/dovecot/template
+++ b/srcpkgs/dovecot/template
@@ -1,8 +1,8 @@
 # Template file for 'dovecot'
 # revbump dovecot-plugin-pigeonhole when updating dovecot!
 pkgname=dovecot
-version=2.3.20
-revision=3
+version=2.3.21
+revision=1
 build_style=gnu-configure
 configure_args="--with-moduledir=/usr/lib/dovecot/modules --with-sql=plugin
  --disable-static --with-pam --with-mysql --with-pgsql --with-lucene
@@ -19,7 +19,7 @@ maintainer="Leah Neukirchen <leah@vuxu.org>"
 license="LGPL-2.1-or-later"
 homepage="https://dovecot.org/"
 distfiles="${homepage}/releases/2.3/${pkgname}-${version}.tar.gz"
-checksum=caa832eb968148abdf35ee9d0f534b779fa732c0ce4a913d9ab8c3469b218552
+checksum=05b11093a71c237c2ef309ad587510721cc93bbee6828251549fc1586c36502d
 keep_libtool_archives=yes
 
 if [ "$CROSS_BUILD" ]; then