Re: ssl error when fetching from one site

Znoteer <[email protected]> wrote:
>
> SimplePOP3SSLRetriever:[email protected]:995:
> getmailrc.xxx: socket error ([SSL: DH_KEY_TOO_SMALL] dh key too small (_ssl.c:727))

It is a problem with the server, essentially.  It's using a weak
Diffie-Hellman key (it's the way a symmetric encryption key for the session is
negotiated at the start of the session without outside parties being able to
figure it out).  It makes the server vulnerable to the Logjam attack, where
someone can force the server to downgrade the connection to an older, insecure
protocol, which can then be decrypted by the attacker.

In theory you might be able to work around this by configuring the client to
use a non-DH-using cipher, but it's almost certainly too difficult, and the
server may not support any of them anyway.

Contact the server admin/postmaster and get them to disable the use of old,
insecure protocol configs.

More info:
https://weakdh.org/

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------