Subject: sslfailure on TLS with Cyrus

From: Steve Huston <[email-masked]>
Date: Fri, 10 Jan 2003 16:46:26 -0500 (EST)

I'm setting up a new Cyrus IMAPD server in testing, and have an odd problem.

If I try to connect normally with Pine 4.44, it will try to escalate the
connection up with TLS, and fails with "SSL negotiation failed".  Debugging
information isn't very useful ("sslfailure: host=diomedes reason=SSL
negotiation failed").  If, however, I tell it to use SSL on port 993, it works
fine (except for the self-signed cert, which I'm not worried about on a test
server).  I can use TLS with Mozilla or Apple's "Mail" program, so I'm not
thinking it's a problem with the Cyrus setup, but I'm stumped.  I've even
setup the cert to be trusted (symlink with hash name in /usr/share/ssl/certs)
but that doesn't seem to have helped.

While I could make the global default to connect with /ssl to the new server,
we have a handful of versions of Pine on the network (oldest is 4.3x I think),
and not all of them support encryption.  Ideally I'd like to have one file on
the network which is symlinked to for all versions of pine, and I could see
this becoming as much of a headache as when we installed the self-signed cert
on our server and having to add /novalidate-cert to half the machines.

Anyone with an idea how I can get a more meaningful error than "negotiation
failed" out of Pine, or Cyrus?  

-- 
Steve Huston - Unix Systems Administrator, Dept. of Astrophysical Sciences
 Princeton University  |     ICBM Address: 40.346525   -74.651285
   126 Peyton Hall     |"On my ship, the Rocinante, wheeling through
 Princeton, NJ   08544 | the galaxies; headed for the heart of Cygnus,
   (609) 258-7375      | headlong into mystery."  -Rush, 'Cygnus X-1'

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------