Re: [fetchmail-users] SSL Ceritficate errors in sendmail log

[Richard <rch...@aa...>]

Thanks Hannes

I am pretty confused about how the certificate stores work in Linux. The
attached screenshot shows that firefox knows all about several Equifax
certificates on the linux machine.
1) Does firefox have a separate store?
2) Could these three certificates all be the wrong ones?
3) How do the firefox certificates get there? I didn't manually load them.
Do they come as part of the firefox pacjage?
4) If I need to manually load the Equifax certificate into openssl - do you
know where I get the Public Equifax certificate from?
5) I don't seem to have /etc/ssl. Any other guesses? How do I find out where
the store is? I'm pretty sure openssl is installed.


Thanks Hannes

Richard.




-----Original Message-----
From: fet...@li...
[mailto:fet...@li...] On Behalf Of Hannes Erven
Sent: Monday, 19 March 2007 5:59 PM
To: fet...@li...
Subject: Re: [fetchmail-users] SSL Ceritficate errors in sendmail log

Hi Richard,


> fetchmail: Issuer Organization: Equifax
> fetchmail: Unknown Issuer CommonName
> fetchmail: Server CommonName: pop.gmail.com
> fetchmail: pop.gmail.com key fingerprint:
> 59:51:61:89:CD:DD:B2:35:94:BB:44:97:A0:39:D5:B4
> fetchmail: Warning: server certificate verification: unable to get local
> issuer certificate


This means fetchmail cannot find Equifax's public certificate on your 
computer.


You need to either:

1. disable the certificate chain check by specifying the certificate's 
(pop.gmail.com's) fingerprint on the account using sslfingerprint, or

2. place the (equinox root) certificate in your system's certificate 
store, usually /etc/ssl, and run c_rehash (an openssl tool) there.
It is also possible to specify another directory using sslcertpath if 
you do not want to make the root equinox certificate available to all 
your users.

HTH,
-hannes
_______________________________________________
fetchmail-users mailing list
fet...@li...
https://lists.berlios.de/mailman/listinfo/fetchmail-users