Subject: TLS/SSL not working with some clients

From: Mark Edwards <[email-masked]>
Date: Wed, 19 Feb 2003 18:25:34 -0800

I have imapd running on a FreeBSD 4.7 box, compiled via the ports tree 
with SSL support (this is the default).

I'm getting the following errors in /var/log/maillog when connecting 
with Squirrelmail 1.4.0 RC2a:

Feb 19 16:40:41 lilbuddy imapd[84173]: Unable to accept SSL connection, 
host=localhost [127.0.0.1]
Feb 19 16:40:41 lilbuddy imapd[84173]: SSL error status: 
error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

I can connect with SSL on port 993 from Mail.app (OSX), Outlook Express, 
and Mozilla mail just fine.  Something is causing a problem when 
connecting with Squirrelmail.  It appears to be an OpenSSL failure, but 
has anyone seen this or does anyone know how to fix it?  I've seen 
reports via google searches of people having the issue using various 
clients, like some versions of Eudora, but I haven't found any claims of 
a solution.

Thanks!

--
Mark Edwards
Engineer
Mr. Toad's
San Francisco, CA

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 19 Feb 2003 18:36:43 -0800 (Pacific Standard Time)

Are you sure that Squirrelmail was built with SSL support?  This looks
like the behavior which occurs when a non-SSL client tries to connect to
an SSL server.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Mark Edwards <[email-masked]>
Date: Wed, 19 Feb 2003 18:41:30 -0800

> Science does not emerge from voting, party politics, or public debate.

Well, this version claims to have TLS support.  I have mod_php4 compiled 
with OpenSSL support, which is what Squirrelmail runs with.

--
Mark Edwards
Engineer
Mr. Toad's
San Francisco, CA

---

From: Mark Crispin <[email-masked]>
Date: Wed, 19 Feb 2003 18:43:42 -0800 (Pacific Standard Time)

> with OpenSSL support, which is what Squirrelmail runs with.

If it is doing TLS, it will make a port 143 connection and negotiate
an IMAP STARTTLS command.

If that's happening on port 993 (SSL), that would be the problem.

-- Mark --

---

From: Mark Edwards <[email-masked]>
Date: Wed, 19 Feb 2003 19:06:14 -0800

I'm also having a different client problem with a different server.  I 
have imapd compiled with SSL and plaintext on my OSX Server 10.1.4 box, 
and Mail.app and Outlook Express are connecting fine (SSL on 993).

However, when I try to use Mozilla Mail to connect using SSL on 993, I 
get this error in /var/log/maillog:

Feb 16 21:43:43 dina imapd[27468]: Unable to accept SSL connection, 
host=lilbuddy.antsclimbtree.com [216.27.183.129]
Feb 16 21:43:43 dina imapd[27468]: SSL error status: error:1408F455:SSL 
routines:SSL3_GET_RECORD:decryption failed or bad record mac

This is very odd, since I have nearly the identical setup on my FreeBSD 
4.7 box, and Mozilla Mail connects just fine.  I think it is something 
with OpenSSL, because exim also reports this error when Mozilla Mail 
tries to connect using STARTTLS on port 25.

Again, I've seen people reporting this problem, but no solution.  Any 
ideas?

Thanks!

--
Mark Edwards
Engineer
Mr. Toad's
San Francisco, CA

---

From: Mark Crispin <[email-masked]>
Date: Wed, 19 Feb 2003 19:11:17 -0800 (Pacific Standard Time)

I don't know anything about Mozilla mail or OSX.

-- Mark --

---

From: Mark Edwards <[email-masked]>
Date: Wed, 19 Feb 2003 19:23:56 -0800

> I don't know anything about Mozilla mail or OSX.

Well, I don't know that this problem is specific to either really.  So, 
do you think I need to talk to an openssl list about this one?  The 
failure is simply with openssl?

--
Mark Edwards
Engineer
Mr. Toad's
San Francisco, CA

---

From: David B Funk <[email-masked]>
Date: Wed, 19 Feb 2003 21:41:16 -0600 (CST)

> routines:SSL3_GET_RECORD:decryption failed or bad record mac

Mark,
You may be able to use the "s_client" function in the 'openssl' tool
to debug this. Try:

        openssl s_client -connect imap.host:993
(with the appropriate substition for "imap.host" ;).

If that works, then try using the command line options to force
specific prototols/ciphers (SSLv3 vs TLSv1, etc) to see if you can
mimic what Mozilla/mail-app are doing.

Also try it from other platforms (EG from your FreeBSD box to your OSX
box) to test interoperability between different implementations of
OpenSSL.

Dave

-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{

---

From: [email-masked] (Jean-Francois Ducarroz)
Date: Thu, 20 Feb 2003 07:34:18 -0800

I am juggesting you to open a bug against Mozilla: 
http://bugzilla.mozilla.org
Even if it's not a Mozilla bug,  some one looking at the bug might find 
the problem.

Jean-Francois

Mark Edwards wrote:

> have imapd compiled with SSL and plaintext on my OSX Server 10.1.4 
> box, and Mail.app and Outlook Express are connecting fine (SSL on 993).
>
> Feb 16 21:43:43 dina imapd[27468]: SSL error status: 
> error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad 
> record mac
>
>
> This is very odd, since I have nearly the identical setup on my 
> FreeBSD 4.7 box, and Mozilla Mail connects just fine.  I think it is 
> something with OpenSSL, because exim also reports this error when 
> Mozilla Mail tries to connect using STARTTLS on port 25.
>