Subject: STARTLLS support

From: Richard A Nelson <[email-masked]>
Date: Wed, 8 Nov 2000 15:39:48 -0500 (EST)

Is anyone looking at STARTTLS support in c-client?

I've got authentication and ssl wrapped smtp working
(I'd tried this already, I'm not sure whats different but it works):
   smtp-server=localhost:465/user=cowboy/ssl/novalidate-cert

Now, I'd like to drop the stunnel, and use the smtp STARTTLS:
$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 badlands.lexington.ibm.com ESMTP Sendmail
8.11.2.Beta0/8.11.2.Beta0/Debian 8.11.0-6; Wed, 8 Nov 2000 15:31:41
-0500
ehlo localhost
250-badlands.lexington.ibm.com Hello root@localhost [127.0.0.1], pleased
to meet you
250-ENHANCEDSTATUSCODES
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ONEX
250-ETRN
250-XUSR
250-AUTH DIGEST-MD5 CRAM-MD5 PLAIN LOGIN ANONYMOUS
250-STARTTLS
250 HELP

I guess c-client would need to try sslwrap/stunnel first, and if that
fails then try STARTTLS (if and only if STARTTLS is in the responce
to the ehlo command).

-- 
Rick Nelson
Life'll kill ya                         -- Warren Zevon
Then you'll be dead                     -- Life'll kill ya

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 8 Nov 2000 12:49:40 -0800 (PST)

> Is anyone looking at STARTTLS support in c-client?

STARTTLS server support already exists.

STARTTLS client support is on the list for a future version.  It will happen
sooner rather than later.

The main holdup was the late unlamented government restrictions on encryption
software, and the complexity required in hiding SSL/TLS support in "cleansed"
sources.  That necessity no longer exists, thankfully.

---

From: Richard A Nelson <[email-masked]>
Date: Fri, 19 Jan 2001 17:27:53 -0500 (EST)

> sources.  That necessity no longer exists, thankfully.

Any news on this front ? My sslwrapper seems to die fairly often for no
apparent reason - it'd be nice to forgo the need of it altogether ;-}
-- 
Rick Nelson
Life'll kill ya                         -- Warren Zevon
Then you'll be dead                     -- Life'll kill ya

---

From: Mark Crispin <[email-masked]>
Date: Fri, 19 Jan 2001 14:31:13 -0800 (PST)

There isn't any news to report about client STARTTLS support yet.  Probably
there will not be until we complete the current release cycle (imap-2000# and
Pine 4.3#) and get back into long-term development; that is, it'll probably
first appear in an imap-2001 beta.

Note that the current distribution supports both client and server with SSL
IMAP -- that is, port 993 -- as well as server-only STARTTLS.  So there
shouldn't be any need to use SSL wrappers; there aren't many clients yet which
implement STARTTLS and none that I know of which only implement STARTTLS and
not port 993.

---

From: Richard A Nelson <[email-masked]>
Date: Fri, 19 Jan 2001 17:43:35 -0500 (EST)

> first appear in an imap-2001 beta.

I hate to ask, but any eta?

> implement STARTTLS and none that I know of which only implement STARTTLS and

My (immediate) concern is smtp, not IMAP:
I'd like to direct connect to my smtp server using STARTTLS
  smtp-server=localhost:25/user=cowboy/ssl/novalidate-cert
Instead of the (problematic) sslwrapper
  smtp-server=localhost:465/user=cowboy/ssl/novalidate-cert

---

From: Mark Crispin <[email-masked]>
Date: Fri, 19 Jan 2001 15:14:11 -0800 (PST)

> I hate to ask, but any eta?

Sometime this year.

>   smtp-server=localhost:465/user=cowboy/ssl/novalidate-cert

Ah, I understand now, especially since The Powers That Be decided to deprecate
port 465 (big sigh!).  OK, I hear you loud and clear.  I'll see about getting
client level TLS support sooner rather than later -- by spring, maybe earlier.

---

From: Richard A Nelson <[email-masked]>
Date: Fri, 19 Jan 2001 18:25:46 -0500 (EST)

> client level TLS support sooner rather than later -- by spring, maybe earlier.

If you need any alpha/beta testers, keep me in mind ;-}

Thanks for listening !!!