Subject: Status of TLS/SSL support for IMAP server?

From: Till Dörges <[email-masked]>
Date: Wed, 14 Jan 2004 16:14:33 +0100

Hi folks,

when looking at the UW IMAP server I was wondering to what extend
TLS/SSL actually is supported.
I went through the mailing-list archive and through some of the code as
well, but I was not able to come up with definitive answers. Hence this
E-Mail (I hope I found the right place to ask questions).

Does the UW IMAP server support

 o  Server certificates			(yes)
 o  Client certificates			(no)
      to allow authentication
 o  CA certificates			(no)
      to recognize valid client certs signed by a CA
 o  Certificate Revocation Lists	(no)
      to recognize invalid/revoked client certs

I put my findings into parentheses.

Any answers/hints appreciated.

TIA -- Till
-- 
Dipl.-Inform. Till Dörges                  PRESECURE (R)
Researcher                               Consulting GmbH
Phone: +49 (0)700 / PRESECURE           [email-masked]

               Treffen Sie uns auf dem DFN-CERT Workshop
                  http://www.dfn-cert.de/events/ws/2004/
                         3. und 4. Februar 2004, Hamburg

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 14 Jan 2004 09:12:43 -0800 (PST)

UW imapd supports server certificates, and the UW c-client client code
supports CA certificate validation of the server certificate.

In order to do CA certificate validation, the CA certificates have to be
installed in the system CA certificate directory (this is usually
/usr/local/ssl/certs but can be different on some systems).  OpenSSL's
install procedure, for some reason, does not install CA certificates so
this has to be done manually.

UW imapd does not validate client certificates; but I do not know of any
IMAP client that supports client certificates so it doesn't matter.  IMAP
clients authenticate to the IMAP server using SASL.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Till Dörges <[email-masked]>
Date: Wed, 14 Jan 2004 19:18:43 +0100

Hi,

thanks for the quick answer. :-)

> UW imapd supports server certificates, and the UW c-client client code
[...]

> IMAP client that supports client certificates so it doesn't matter.

The Courier imapd supports client certificates. It's even possible to
insist on a valid client certificate. The certificate, however, can't be
used to authenticate a client (at least not to the very best of my
knowledge.)

The situation seems similar for the Cyrus imapd. I haven't tested it though.

> IMAP clients authenticate to the IMAP server using SASL.

I know, but if the users already have a valid certificate, they might
use it for authentication as well. This saves one set of credentials
(login + password for imap) to be taken care of.

Bye -- Till