Re: Bug with imap.gmail.com and getmail TLS validation

I'm using FreeBSD 12.0, and yes, this is using OpenSSL 1.1.1 which I
believe is the first version which has supported TLSv1.3. That is
probably what has exposed this issue.

So if getmail isn't using imaplib2 and is just using imaplib from the
python standard library then it might be something that needs solving
there. Except of course it's python 2.x which is soon going to be EOL.

On Tue, 29 Jan 2019 at 18:03, ndre <[email protected]> wrote:
>
> Hi,
>
> Tue 29 Jan 2019 às 10:20:06 (1548768006), [email protected] enviou:
> > Hi,
> >
> > If using imap.gmail.com with the ca_certs option configured to point
> > at a valid set of CA root certificates then the certificate validation
> > fails with the following error:
> >
> > gmail: operation error (socket sslerror during connect ([SSL:
> > CERTIFICATE_VERIFY_FAILED] certificate verify
> > failed (_ssl.c:726)))
> >
> > If you try the same connection using openssl s_client then it
> > successfully connects and validates.
> >
> > The reason appears to be an issue with TLSv1.3. If you set ssl_version
> > = tlsv1_2 in the getmail config then it works as expected.
> >
> > Googling for a similar issue has shown me this thread:
> > https://github.com/OfflineIMAP/offlineimap/issues/573 which suggests
> > that it's something to do with imaplib2 not supporting TLSv1.3 + SNI.
> > I guess getmail uses the same lib?
> >
> > It looks like the upstream imaplib2 is completely abandoned. So I
> > don't know what the best solution is going to be.
>
> I had the same issue a while ago and it showed itself on my system
> after upgrading libssl to 1.1.1. At the same time, debian buster
> changed its policy to not accept TLS versions prior to 1.2. At the
> time, I tried to debug the issue but could not ascertain if it really
> was a bug on my system or if it was some misconfiguration on google's
> side (since it only showed itself when trying to connect to their
> servers). Due to lack of time and knowledge I just set the
> ssl_version flag as you suggested and decided to way and see if I was
> the only one affected.
>
> So now, two questions: are you using buster and/or libssl1.1?
>     Have you tried to connect to different mail providers and got the
>     same issue? On a side note: do any of these providers use TLS 1.3?