search

pulb / mailnag

An extensible mail notification daemon
GNU General Public License v2.0
253 stars 32 forks source link

Problem with expired certificate #172

Open alexis12 opened 6 years ago

alexis12 commented 6 years ago

Hello, I encountered this error when trying to access an account with an expired certificate (via IMAP).

ERROR: Failed to open mailbox for account ([SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:661)).

If I uncheck the option 'Enable SSL encryption' it works OK, but I guess that all traffic is unencrypted. Would it be a good idea to add an option to mailnag.cfg e.g. ssl_verify_date = 0 for such exceptional cases so as not to disable the encryption completely when the certificate has expired?

Edit: For some reason, I don't get a warning "Using unencrypted connection for account [...]" even though 'Enable SSL encryption is disabled.

wshanks commented 6 years ago

Are you sure that the certificate is expired? I found this issue while trying to understand the same WRONG_VERSION_NUMBER error message. In my case, my email provider does not support SSLv2 or SSLv3. It only supports TLS 1.0 through 1.2 and does not allow unencrypted access. If you look at this block, you can see that if SSL is selected, it tries to use SSL. Otherwise, it tries to use STARTTLS and then falls back to no encryption. Since you don't see the warning, you must also be connecting with STARTTLS.

The UX is a little weird. You select the SSL option to enable a legacy form of encryption. Otherwise you either get the latest form of encryption or you get no encryption. I would have expected STARTTLS to be the default, then fall back to SSL and then fall back to no encryption, possibly with the option not to fall back to SSL or no encryption.