Re: getmail and weakdh.org ssl issue
Charles Cazabon <[email protected]>
| Newsgroups | gmane.mail.getmail.user |
|---|---|
| Message-ID | <[email protected]> |
Stefan U. Hegner <[email protected]> wrote: > > > > I'm 99% certain then that this is because of the server's certificate. I > > can't check myself because you've anonymized it. > > OK, then I tell you ;-) > > It's mail.unseen.is (POP-SSL on Port 995) That server appears to be *badly* misconfigured. They're still supporting RC4, as well as other non-PCI-DSS-compliant cyphers. And the DH parameter on that server is indeed weak, only 1024 bits, which also fails PCI-DSS requirements. There are other minor problems as well, but this is definitely the cause of your connection errors. It will affect all programs connecting with OpenSSL to that server, not just getmail. You may be able to make apps on buster talk to this server by fiddling with configuration in /etc/ssl/ or with envvars, but the right solution is to have the server operator fix the problems. This server needs a good cleanup of its certificate configuration. https://www.immuniweb.com/ssl/?id=pGnM5Gi5 is the report I just ran. I don't know how long that link will stay valid, but you can retest it if necessary. Charles -- ----------------------------------------------------------------------- Charles Cazabon GPL'ed software available at: http://pyropus.ca/software/ -----------------------------------------------------------------------