Thread: [fetchmail-users] unable to get local issuer certificate

Client daemon to move mail from POP and IMAP to your local computer

Brought to you by: m-a, question42, robfunk

fetchmail-users

[fetchmail-users] unable to get local issuer certificate

From: Andy M. <an...@oa...> - 2008-09-12 18:10:45

Hello All,


I'm currently trying to get fetchmail release 6.3.8+SSL+HESIOD+NLS
working but am running into problems with SSL certificate verification.

The version of OpenSSL I am using is OpenSSL 0.9.8d on RHEL 4.


I have specified the following options in my config file :

poll mymailhost proto pop3 uidl no dns
user mailuser
sslcertck sslcertpath /usr/share/ssl/certs

When I invoke fetchmail, I get the following :

Enter password for mailuser@mymailhost:
fetchmail: 6.3.8 querying mymailhost (protocol POP3) at Fri Sep 12
10:59:10 2008: poll started
Trying to connect to 10.0.0.17/995...connected.
fetchmail: Server certificate verification error: unable to get local
issuer certificate
29071:error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
failed:s3_clnt.c:843:
fetchmail: SSL connection failed.
fetchmail: socket error while fetching from mailuser@mymailhost
fetchmail: 6.3.8 querying mymailhost (protocol POP3) at Fri Sep 12
10:59:10 2008: poll completed
fetchmail: Query status=2 (SOCKET)
fetchmail: normal termination, status 2


If I remove the sslcertck option, things work fine.


If I run :

	openssl s_client -connect mymailhost:993 -CApath /usr/share/ssl/certs

Things appear to be OK, i.e., The SSL Handshake completes ok with Verify
return code of 0.


	---
No client certificate CA names sent
---
SSL handshake has read 3444 bytes and written 324 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 1024 bit
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-MD5
    Session-ID:
00230000FEE53D7423C28619FDCF68290F4EAE2085FB2CEC0EC81A9E329B883D
    Session-ID-ctx:
    Master-Key:
60818B7C1768717DD3E919C45A9B9D847196BBAD212C56C83E8A664931E5AA8A1EFFC537EFB4BDBC502AF87D0AC91185
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1221231692
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
	---


Any ideas of input one may provide will be greatly appreciated.


Thanks,

	---Andy

[fetchmail-users] unable to get local issuer certificate

From: Tim J. <ti...@ak...> - 2011-10-16 23:58:15

FYI: Linux user, setting up on Mac Lion (Darwin Kernel Version
11.2.0). Comfortable with command line, but not a virtuoso, new to
Mac.

When attempting to fetch mail for pop.gmail.com the following error
messages are generated :
####################################################################
fetchmail: Server certificate verification error: unable to get local issuer
certificate fetchmail: This means that the root signing certificate (issued for
/C=US/O=Google Inc/CN=Google Internet Authority) is not in the trusted CA
certificate locations, or that c_rehash needs to be run on the certificate
directory. For details, please see the documentation of --sslcertpath and
--sslcertfile in the manual page.  fetchmail: Certificate/fingerprint
verification was somehow skipped!  fetchmail: SSL connection failed.
fetchmail: socket error while fetching from tim...@po... fetchmail:
6.3.18 querying pop.gmail.com (protocol POP3) at Sun, 16 Oct 2011 10:20:39
-0800 (AKDT): poll completed fetchmail: Query status=2 (SOCKET)
####################################################################
cert files are in /Users/tim/.certs
Two files were created from 
openssl s_client -connect pop.gmail.com:995 -showcerts
1)gmail.pem = google cert
2)equifax.pem = equifax cert
c_rehash was run after certificates were installed.
permissions :
  cert files are 644 tim:staff
  cert directory is 755

Polling code in .fetchmailrc is

poll pop.gmail.com with proto POP3 user '*********' there with
password '******' is 'tim' here mda "/usr/bin/procmail" options ssl
sslcertck sslcertpath /Users/tim/.certs

Entry from fetchmail -V :
#####################################################################################
Options for retrieving from *********@pop.gmail.com:
  True name of server is pop.gmail.com.
  Protocol is POP3.
  All available authentication methods will be tried.
  SSL encrypted sessions enabled.
  SSL server certificate checking enabled.
  SSL trusted certificate directory: /Users/tim/.certs
  Server nonresponse timeout is 300 seconds (default).
  Default mailbox selected.
  Only new messages will be retrieved (--all off).
  Fetched messages will not be kept on the server (--keep off).
  Old messages will not be flushed before message retrieval (--flush off).
  Oversized messages will not be flushed before message retrieval (--limitflush off).
  Rewrite of server-local addresses is enabled (--norewrite off).
  Carriage-return stripping is enabled (stripcr on).
  Carriage-return forcing is disabled (forcecr off).
  Interpretation of Content-Transfer-Encoding is enabled (pass8bits off).
  MIME decoding is disabled (mimedecode off).
  Idle after poll is disabled (idle off).
  Nonempty Status lines will be kept (dropstatus off)
  Delivered-To lines will be kept (dropdelivered off)
  Fetch message size limit is 100 (--fetchsizelimit 100).
  Do binary search of UIDs during 3 out of 4 polls (--fastuidl 4).
  Messages will be delivered with "/usr/bin/procmail".
  Single-drop mode: 1 local name recognized.
  No UIDs saved from this host.

I'm not new to fetchmail, but I haven't done any config in years.
Please advise
thanks
-- 
Tim 
tim at tee jay forty nine dot com or akwebsoft dot com
http://www.akwebsoft.com