Re: Problems connecting to imap after upgrade of openssl to v3

Thanks Sam,

After reenabling the legacy and weak algorithms IPv4 will connect.

But as my server is dual-stack and prefers IPv6 i get a new error.

When I run the following command :
# openssl s_client --connect mail.kristian-duus.dk:143 -starttls imap
>
> removed long listing with the found certificates
>
---
read R BLOCK
40B73AAA527F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version  
number:../openssl-3.0.11/ssl/record/ssl3_record.c:358:

But if I enter the IPv4 address x.x.x.x:143 or the IPv6 [x:x:x:x::x]:143 I  
get a connection to the server. If I type in the IPv6-address without the  
square brackets I get the same error as with the hostname.

Can you help me get closer to a solution ?

Regards
  Kristian

Sam Varshavchik writes:

> OpenSSL has a rich history of cryptic, undecipherable errors, for decades.
>
> A Google search suggests that your certificate uses an older hashing
> algorithm, most likely DES-CBC, that OpenSSL 3 no longer supports by
> default.
>
> Good news is they say that "It's a feature, not a regression", see
> https://github.com/openssl/openssl/issues/17378
>
> A few more Google searches point to a likely solution: voodoo changes to
> openssl.cnf:
>
> https://help.heroku.com/88GYDTB2/how-do-i-configure-openssl-to-allow-the- 
> use-of-legacy-cryptographic-algorithms
>
> This is for some software package's explicit configuration, but you'll
> probably find an `openssl.cnf`, somewhere, and making the indicated changes
> there will likely effect all installed software that uses OpenSSL,
> including Courier.
>
>
> On Tue, Oct 17, 2023 at 5:39 PM Kristian Duus Østergaard <
> [email protected]> wrote:
>
>> Hi,
>>
>> I have just upgraded to openssl 3 on my gentoo server and whenever I try
>> to
>> connect to the imapd daemon I get :
>>
>> couriertls: /usr/share/courier/imapd.pem.mail.kristian-duus.dk: error:
>> 1E08010C:DECODER routines::unsupported
>>
>> This worked perfectly two days ago using the older openssl-1.1.1u
>>
>> And in my folly I have upgraded courier from 1.2.3 to 1.3.3 to see if it
>> included a patch related to openssl-3.
>>
>> Can anyone point me to what options I might have forgotten when upgrading
>> openssl ?
>>
>> Regards
>> Kristian
>>
>> --
>> Mvh.
>>   Kristian Duus Østergaard
>>   M 2211 4772
>>   E [email protected]
>>
>>
>> _______________________________________________
>> courier-users mailing list
>> [email protected]
>> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
>>

-- 
Mvh.
  Kristian Duus Østergaard
  M 2211 4772
  E [email protected]


_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users