Re: Bug with imap.gmail.com and getmail TLS validation

ndre <[email protected]> Tue, 29 Jan 2019 16:03:21 -0200

Newsgroups	gmane.mail.getmail.user
Message-ID	<[email protected]>

Hi,

Tue 29 Jan 2019 às 10:20:06 (1548768006), [email protected] enviou:
> Hi,
> 
> If using imap.gmail.com with the ca_certs option configured to point
> at a valid set of CA root certificates then the certificate validation
> fails with the following error:
> 
> gmail: operation error (socket sslerror during connect ([SSL:
> CERTIFICATE_VERIFY_FAILED] certificate verify
> failed (_ssl.c:726)))
> 
> If you try the same connection using openssl s_client then it
> successfully connects and validates.
> 
> The reason appears to be an issue with TLSv1.3. If you set ssl_version
> = tlsv1_2 in the getmail config then it works as expected.
> 
> Googling for a similar issue has shown me this thread:
> https://github.com/OfflineIMAP/offlineimap/issues/573 which suggests
> that it's something to do with imaplib2 not supporting TLSv1.3 + SNI.
> I guess getmail uses the same lib?
> 
> It looks like the upstream imaplib2 is completely abandoned. So I
> don't know what the best solution is going to be.

I had the same issue a while ago and it showed itself on my system
after upgrading libssl to 1.1.1. At the same time, debian buster
changed its policy to not accept TLS versions prior to 1.2. At the
time, I tried to debug the issue but could not ascertain if it really
was a bug on my system or if it was some misconfiguration on google's
side (since it only showed itself when trying to connect to their
servers). Due to lack of time and knowledge I just set the
ssl_version flag as you suggested and decided to way and see if I was
the only one affected.

So now, two questions: are you using buster and/or libssl1.1?
    Have you tried to connect to different mail providers and got the
    same issue? On a side note: do any of these providers use TLS 1.3?

signature.asc (application/pgp-signature, 841 B)