Re: smtp authentication fails

On Thu, 6 Dec 2007, robert delius royar wrote:

> Thu, 6 Dec 2007 (10:50 -0800 UTC) Marc Greene wrote:
>
>>> It may be necessary to manually download the certificate for Pine to
>>> find in a local directory. It is also possible the certificate is
>>> not correctly written, using something other than "lavabit.com". I
>>> once suffered the problem until I realized the provided smtp-server
>>> system setup info did not match the certificate. Pine needs specific
>>> smtp-server name to validate - double check certificate! Is the
>>> certificate created with a prefix domain name "xxxx.lavabit.com"
>>> or something?
>> 
>> I'm don't know where I would manually download the certificate, or
>> where I should put it so pine can find it. I tried using mail.lavabit.com,
>> and smtp.lavabit.com, but they just give me the same error.
>> 
>
> Try this command if you have openssl installed:
> openssl s_client -connect mail.lavabit.com:993 -CApath /Path/to/your/certs
>
> You will find they have a certificate from GoDaddy.com with the following
> subject=/O=*.lavabit.com/OU=Domain Control Validated/CN=*.lavabit.com
> issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, 
> Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure 
> Certification Authority/serialNumber=07969287
>
> So add this to your root CA directory
> https://certificates.godaddy.com/repository/valicert_class2_root.crt
>
> make a symbolic link to that file (inside your certs directory:
> sudo ln -s valicert_class2_root.crt /System/Library/OpenSSL/certs/bcdd5959.0
>
> I found the MD5 value (bcdd5959) with the following command
> openssl x509 -hash -noout -in 
> /System/Library/OpenSSL/certs/valicert_class2_root.crt
>
> Then I tried the
> openssl s_client -connect mail.lavabit.com:993 -CApath 
> /System/Library/OpenSSL/certs
> command again and received an OK verified code of 0.

So I did the following as you instructed:

root@riverstone:~# cd /etc/ssl/certs
root@riverstone:/etc/ssl/certs# wget --no-check-certificate 
https://certificates.godaddy.com/repository/valicert_class2_root.crt
--04:14:45-- 
https://certificates.godaddy.com/repository/valicert_class2_root.crt
            => `valicert_class2_root.crt'
Resolving certificates.godaddy.com... 64.202.160.39
Connecting to certificates.godaddy.com|64.202.160.39|:443... 
connected.
WARNING: Certificate verification error for 
certificates.godaddy.com: self signed certificate in 
certificate chain
HTTP request sent, awaiting response... 200 OK
Length: 1,084 (1.1K) [application/x-x509-ca-cert]

100%[====================================>] 1,084 
--.--K/s

04:14:46 (113.67 KB/s) - `valicert_class2_root.crt' saved 
[1084/1084]

root@riverstone:/etc/ssl/certs# ln -s valicert_class2_root.crt 
/etc/ssl/certs/bcdd5959.O
root@riverstone:/etc/ssl/certs# openssl s_client -connect 
mail.lavabit.com:993 -CApath /etc/openssl/certs

[...]
  Verify return code: 20 (unable to get local issuer 
certificate)
---
* OK lavabit.com IMAP4rev1 lavad server ready.

I still get the "unable to get local issuer certificate". I'm 
not sure why though. I did notice while in my compile log for 
pine, that I saw this notice:

   File /etc/ssl/certs/factory.pem is missing
   This might indicate that CA certs did not get properly
   installed.  If you get certificate validation failures
   in Pine, this might be the reason for them.

I couldn't find a "factory.pem" file anywhere in my system, I 
wonder if that has anything to do with it. I haven't been very 
successful in finding out what it means.

Pine also still gives me the "unable to get local issuer 
certificate" message as well (unless I specify 
novalidate-cert).

Thanks for the suggestions though!

Marc

_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info