Subject: PCPine 4.43 wildcard certificate bug

From: Brian Murphy <[email-masked]>
Date: Mon, 3 Dec 2001 15:44:52 -0700

PCPine 4.43 fails during SSL/TLS certificate validation.

The reason quoted is:

	Server name does not match certificate

The details screen says the following:

Host given by user:

  murphy.inbox.email.arizona.edu

Reason for failure:

  Server name does not match certificte

Certificate being verified:

  C=US, S=Arizona, L=Tucson, O=The University of Arizona, OU=CCIT, CN=*.email.arizona.edu

(End of details screen)

As you can clearly see, murphy.inbox.email.arizona.edu should be covered
by *.email.arizona.edu.  And additionally, other mail clients work fine.

This is from PCPine on Win98, but it seems to hold for all versions of
windows.

If I answer "Yes" to ignore the warning and continue, pine says:

[IMAP Authentication cancelled]
[No folder opened]

And similarly, if I add the /novalidate-cert option, I get the same
[IMAP Authentication cancelled] message.

So, first, is this being worked on?

Second, is this an appropriate forum for bugs?

Third, is there some sort of bug list or tracking system that I can
look at to follow this bug?

Thanks.

Brian Murphy
-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Dec 2001 17:08:12 -0800 (PST)

On Mon, 3 Dec 2001 15:44:52 -0700, Brian Murphy wrote:
> by *.email.arizona.edu.

The authors of OpenSSL (UNIX) and SSPI (Microsoft) disagree with you.  Pine's
certificate validation uses OpenSSL's ssl_compare_hostnames() on UNIX, and
SSPI's CertVerifyCertificateChainPolicy() on the PC.

I also spoke to our local security/SSL/certificate management guru, and he
confirmed that a * wildcard does not cross subdomain boundaries.

> And additionally, other mail clients work fine.

Do those other clients validate certificates?

> [IMAP Authentication cancelled] message.

This is a bug in the murphy.inbox.email.arizona.edu server.  I do not know
what server implementation this is; the only identification in its startup
banner is "IMAP4 server ready (6.0.036)".

When TLS is in effect, it offers the AUTH=PLAIN SASL authentication mechanism.
The failing dialog with the server goes like this:
	S: 00000003 AUTHENTICATE PLAIN
--->	S: + go ahead
	C: *
	S: 00000003 NO authentication aborted

The problem is in the indicated line.  The text of a command continuation
request response in the AUTHENTICATE command is a server challenge in BASE64
representation (RFC 2060, page 21, second paragraph).  This is different from
command continuation request responses in other commands, which permit free
form text.

"go ahead" is not valid BASE64, due to the embedded space.

Furthermore, since there is no initial challenge in the PLAIN mechanism (RFC
2595, page 8, third paragraph), that challenge is required to be be zero
length (RFC 2222, page 5, section 5.1, third paragraph).  Hence, the server
should have send just "+ ".

Since the server violated SASL (RFC 2222) and IMAP (RFC 2060) protocol, Pine's
IMAP client abandoned the authentication attempt.

> So, first, is this being worked on?

I don't know.  Ask your local help desk if they are working on fixing the
incorrect certificate and the bugs in your local IMAP server.

> Second, is this an appropriate forum for bugs?

Better is email to [email-masked].

> look at to follow this bug?

We have an in-house bug tracking system, but I don't think that it is
available outside of our group.

---

From: "S. Alexander Jacobson" <[email-masked]>
Date: Thu, 6 Dec 2001 11:12:06 -0500 (EST)

I have my inbox sorted by reverse-arrival time (so newer stuff is on top).
However, I would still like to read my newer mail in temporal order.
Is there a way to set the delete key to move UP after I delete a message
rather than down?

I find myself doing Delete-Up-Up all the time, when I would much ratehr
just hit Delete and have the cursor be on the next message in temporal
order (even though I am sorted reverse).

Alternatively, is there a way to enable the Backspace key on lists to do
backward delete on lists, just as it does in text?

-Alex-

___________________________________________________________________
S. Alexander Jacobson			i2x Media
1-917-783-0889 voice			1-212-697-1427 fax