Re: Bug with imap.gmail.com and getmail TLS validation

ndre <[email protected]> Tue, 29 Jan 2019 17:27:10 -0200
Newsgroups	gmane.mail.getmail.user
Message-ID	<[email protected]>
Tue 29 Jan 2019 às 18:14:58 (1548796498), [email protected] enviou:
> I'm using FreeBSD 12.0, and yes, this is using OpenSSL 1.1.1 which I
> believe is the first version which has supported TLSv1.3. That is
> probably what has exposed this issue.
> 
> So if getmail isn't using imaplib2 and is just using imaplib from the
> python standard library then it might be something that needs solving
> there. Except of course it's python 2.x which is soon going to be EOL.

There's no need to add me to CC, I'm on the list of subscribers.
I'm short on time to play around right now, but I'll give it another
go if in the mean time no one else finds the culprit.

> On Tue, 29 Jan 2019 at 18:03, ndre <[email protected]> wrote:
> >
> > I had the same issue a while ago and it showed itself on my system
> > after upgrading libssl to 1.1.1. At the same time, debian buster
> > changed its policy to not accept TLS versions prior to 1.2. At the
> > time, I tried to debug the issue but could not ascertain if it really
> > was a bug on my system or if it was some misconfiguration on google's
> > side (since it only showed itself when trying to connect to their
> > servers). Due to lack of time and knowledge I just set the
> > ssl_version flag as you suggested and decided to way and see if I was
> > the only one affected.
> >
> > So now, two questions: are you using buster and/or libssl1.1?
> >     Have you tried to connect to different mail providers and got the
> >     same issue? On a side note: do any of these providers use TLS 1.3?

I've forgot to mention two things that may be relevant for you or
others trying to tackle the problem:

-  I consistently get two different ciphers when trying to connect
using getmail and openssl s_client:
   getmail:
     ECDHE-RSA-AES128-GCM-SHA256:TLSv1.2
   openssl:
     TLSv1.2, Cipher is ECDHE-RSA-CHACHA20-POLY1305
   So even with openssl the protocol is not TLS 1.3, but 1.2.

- The first time the issue presented itself, I remember also getting
different certificate fingerprints, but it did not happen again when
I tried this timei around.
signature.asc (application/pgp-signature, 841 B)