Re: Bug with imap.gmail.com and getmail TLS validation

On 2019-01-29 22:04, Matt Smith wrote:

> I do not *yet* have this issue with other imap servers, but all the
> other imap servers that I use are TLSv1.2 maximum, whereas gmail is
> TLSv1.3 maximum.
> 
> With ssl_version = tlsv1_2 we get this:
> 
> _connect() [_retrieverbases.py:599] establishing IMAP SSL connection
> to imap.gmail.com:993 using protocol ve
> rsion TLSV1_2, with ca_certs /usr/local/etc/ssl/cert.pem
> _connect() [_retrieverbases.py:699] IMAP SSL connection
> <getmailcore._retrieverbases.IMAP4_SSL_EXTENDED inst
> ance at 0x801bdda28> established with fingerprint
> 8ca13e0411ebab888e5909e693dc5c5925ee9aec9124eaeb2ae7b820d1
> 6df696 using cipher ECDHE-RSA-AES128-GCM-SHA256:TLSv1.2:128
> 
> With that option commented out we get this:
> 
> _connect() [_retrieverbases.py:599] establishing IMAP SSL connection
> to imap.gmail.com:993 with ca_certs /usr/local/etc/ssl/cert.pem
> abort() [_retrieverbases.py:1757] trace
> gmail: operation error (socket sslerror during connect ([SSL:
> CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)))
> 

I'm not very good at  this stuff.
might this be something to do with gmail having different certificates 
for different servers.
When using fetchmail and specifying the ssl fingerprint it would work 
for weeks and then suddenly get a different fingerprint which I assumed 
was the way it is decided which server to connect to.

cheers

mick
-- 
Key ID    C7D6E24C