Re: [Fetchmail-users] Unable to fetch mail from "outlook"

[Matthias A. <mat...@gm...>]

Am 06.04.2015 um 11:24 schrieb Jerry:
> Fetchmail was working just fine until a few days ago. I have an account at
> "outlook,com", formerly "hotmail.com". Fetchmail now cannot fetch mail from
> that site.

Yeah.  What does make it a fetchmail problem?

> I am running FreeBSD-10. I update "openssl" to version "OpenSSL
> 1.0.1l-freebsd 15 Jan 2015". After that, fetchmail fails. This is the log entry:
> 
> fetchmail: 6.3.26 querying pop3.live.com (protocol POP3) at Mon Apr  6 05:05:59 2015: poll started
> Trying to connect to 65.55.162.199/995...connected.
> fetchmail: SSL connection failed.
> fetchmail: socket error while fetching from me...@ou...@pop3.live.com
> fetchmail: 6.3.26 querying pop3.live.com (protocol POP3) at Mon Apr  6 05:06:00 2015: poll completed
> Merged UID list from pop3.live.com: <empty>
> fetchmail: Query status=2 (SOCKET)
> fetchmail: normal termination, status 2
> 
> Using "openssl" works fine:

No it does not. You are not feeding it similar options to fetchmail's,
and openssl's s_client will not bail out if verification fails.

> ~ $ openssl s_client -crlf -showcerts -connect pop3.live.com:995
...
>     Verify return code: 20 (unable to get local issuer certificate)

Oops.  That's not "fine" in my book.  You don't have trust anchors (but
you neither gave -CApath nor -CAfile to point s_client to them).

> poll pop3.live.com with proto POP3 service 995 timeout 30 and options bad-header accept
> user 'ger...@ou...' there with password 'PASSWORD' is 'ME' here options flush forcecr dropdelivered smtpname 'ME...@My...' ssl sslfingerprint '86:60:F6:38:1C:84:A6:AC:94:92:51:2F:67:9A:7D:76'
> 
> Does anyone have any idea what the problem is?

I'm afraid not.  That configuration works for me with the same OpenSSL
version on FreeBSD 10.1-RELEASE-pwhatever on amd64 up to the point where
it chats to the server, which then tells me that that made-up password
isn't good for logging in, this is what I'm getting:

>>| $ LC_ALL=C fetchmail -f /tmp/testrc  
>>| fetchmail: Authorization failure on ger...@ou...@pop3.glbdns2.microsoft.com
>>| fetchmail: Query status=3 (AUTHFAIL)

Now, you've been around mail and lists for long enough to know that you
might want to read the FAQ before posting, and that you will not get
support unless you provide verbose logs...
<http://www.fetchmail.info/fetchmail-FAQ.html#G3>

Specifically for FreeBSD, install ca_root_nss and add -verify 5 -CAfile
/usr/local/share/certs/ca-root-nss.crt  to the s_client command line.
You should not need these for fetchmail though as long as you go without
--sslcertck but with --sslfingerprint '...'.