Subject: problem with pine and STARTTLS

From: "William D. Colburn (aka Schlake)" <[email-masked]>
Date: Tue, 7 May 2002 09:49:10 -0600

I'm trying to make pine and imap work together with STARTTLS.  I have a
real key from Thawte, and I put it where the docs told me to.  I
compiled imap-2001a with the SSL stuff.  I have a macintosh that seems
to be able to do STARTTLS with the server, but neither pine or eudora
work.

I sniffed the transaction between pine/imap and got this:
>* OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS STARTTLS AUTH=LOGIN] localhost IMAP4rev1 2001.315 at Tue, 7 May 2002 09:25:44 -0600 (MDT)
>00000000 LOGOUT
>* BYE mailhost IMAP4rev1 server terminating connection
>00000000 OK LOGOUT completed

>From what I can tell, imapd is advertising STARTTLS, but pine is
ignoring it and immediately disconnecting.  Here is some of what the
debug file pine produced:

>IMAP 09:25:44 5/7 mm_log babble: Trying IP address [127.0.0.1]
>IMAP 09:25:44 5/7 mm_log ERROR: Unable to negotiate TLS with this server

If I try to connect to the imapd with Eudora (and sniff the network) I
see that Eudora does a STARTTLS, and after a few handshakes of garbage
goes back and forth Eudora reports that the negotiated key size is -1.

I use the same certificate/key with the Qualcomm qpopper and sendmail,
and STARTTLS works correctly in both of those.

Any help would be appreciated.

--
William Colburn, "Sysprog" <[email-masked]>
Computer Center, New Mexico Institute of Mining and Technology
http://www.nmt.edu/tcc/     http://www.nmt.edu/~wcolburn
-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 14 May 2002 11:32:22 -0700 (Pacific Daylight Time)

On Tue, 7 May 2002, William D. Colburn (aka Schlake) wrote:
> real key from Thawte, and I put it where the docs told me to.

What is the IMAP server DNS name and IP address, so that I can contact it
and see what may be going on?

Where did you install the key file?  If you installed using the IP
address based name, then it won't work for localhost unless you also
install it for 127.0.0.1.

> * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS STARTTLS AUTH=LOGIN] localhost IMAP4rev1 2001.315 at Tue, 7 May 2002 09:25:44 -0600 (MDT)

This indicates that the server is built with SSL/TLS

> IMAP 09:25:44 5/7 mm_log ERROR: Unable to negotiate TLS with this server

What do you get in the mail syslog on the server?  There may be an error
message that explains what's wrong.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Ziying Sherwin <[email-masked]>
Date: Tue, 14 May 2002 14:58:30 -0400 (EDT)

Marc,

Thanks so much. Now it works. Thanks for the idea of checking mail
syslog. I should have thought of it earlier. From the log, it turned out
that the imap daemon could not load the certificate correctly. And I
double checked the documentation and found that the self-signed
certificate that we created does not have the format that imap requires.

We created the certificate by using the following two commands:

   CA.pl -newreq
   CA.pl -sign

Then we copied the newcert.pem to the certs/ directory without any
modification. That certificate has plain text description and certificate
body, but does not have RSA private key. However imap daemon is looking for a 
certificate comes with RSA private key and certificate body.

Now we are using command 

   openssl req -new -x509 -nodes -out imapd.pem -keyout imapd.pem -days
3650

And that certificate works fine with the imap daemon.

After we configured pine and tell it to continue with self-signed
certificate, it can log onto the mail server and fetch the mail correctly. 

Thanks again for all the help.

Ziying