Re: Problems connecting to imap after upgrade of openssl to v3

You can use the -4 and the -6 option
https://manpages.debian.org/bookworm/openssl/openssl-s_client.1ssl.en.html

Idézem/Quoting Kristian Duus Østergaard <[email protected]>:

> Thanks Sam,
>
> After reenabling the legacy and weak algorithms IPv4 will connect.
>
> But as my server is dual-stack and prefers IPv6 i get a new error.
>
> When I run the following command :
> # openssl s_client --connect mail.kristian-duus.dk:143 -starttls imap
>>
>> removed long listing with the found certificates
>>
> ---
> read R BLOCK
> 40B73AAA527F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong  
> version number:../openssl-3.0.11/ssl/record/ssl3_record.c:358:
>
> But if I enter the IPv4 address x.x.x.x:143 or the IPv6  
> [x:x:x:x::x]:143 I get a connection to the server. If I type in the  
> IPv6-address without the square brackets I get the same error as  
> with the hostname.
>
> Can you help me get closer to a solution ?
>
> Regards
>  Kristian
>
> Sam Varshavchik writes:
>
>> OpenSSL has a rich history of cryptic, undecipherable errors, for decades.
>>
>> A Google search suggests that your certificate uses an older hashing
>> algorithm, most likely DES-CBC, that OpenSSL 3 no longer supports by
>> default.
>>
>> Good news is they say that "It's a feature, not a regression", see
>> https://github.com/openssl/openssl/issues/17378
>>
>> A few more Google searches point to a likely solution: voodoo changes to
>> openssl.cnf:
>>
>> https://help.heroku.com/88GYDTB2/how-do-i-configure-openssl-to-allow-the-use-of-legacy-cryptographic-algorithms
>>
>> This is for some software package's explicit configuration, but you'll
>> probably find an `openssl.cnf`, somewhere, and making the indicated changes
>> there will likely effect all installed software that uses OpenSSL,
>> including Courier.
>>
>>
>> On Tue, Oct 17, 2023 at 5:39 PM Kristian Duus Østergaard <
>> [email protected]> wrote:
>>
>>> Hi,
>>>
>>> I have just upgraded to openssl 3 on my gentoo server and whenever I try
>>> to
>>> connect to the imapd daemon I get :
>>>
>>> couriertls: /usr/share/courier/imapd.pem.mail.kristian-duus.dk: error:
>>> 1E08010C:DECODER routines::unsupported
>>>
>>> This worked perfectly two days ago using the older openssl-1.1.1u
>>>
>>> And in my folly I have upgraded courier from 1.2.3 to 1.3.3 to see if it
>>> included a patch related to openssl-3.
>>>
>>> Can anyone point me to what options I might have forgotten when upgrading
>>> openssl ?
>>>
>>> Regards
>>> Kristian
>>>
>>> --
>>> Mvh.
>>>  Kristian Duus Østergaard
>>>  M 2211 4772
>>>  E [email protected]
>>>
>>>
>>> _______________________________________________
>>> courier-users mailing list
>>> [email protected]
>>> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
>>>
>
> -- 
> Mvh.
>  Kristian Duus Østergaard
>  M 2211 4772
>  E [email protected]
>
>
> _______________________________________________
> courier-users mailing list
> [email protected]
> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users



SZÉPE Viktor, webes alkalmazás üzemeltetés / Running your application
https://github.com/szepeviktor/debian-server-tools/blob/master/CV.md
~~~
ügyelet 🌶️ hotline: +36-20-4242498  [email protected]  skype: szepe.viktor
Budapest, III. kerület

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users