[Fetchmail-users] EE certificate key too weak error from fetchmail

[David M. <dm...@in...>]

I have a Ubuntu computer at home. My email gets delivered to a Centos 7 server.

To get my email, I open an ssh tunnel from my home computer to the server
connecting my port 7110 to the server port 110. Then I point fetchmail at local
port 7110 to fetch my email.

This worked just fine on Ubuntu 18.04 LTS (and previous versions). However, I
recently updated to Ubuntu 20.04, and the fetchmail stopped working. The Centos
server has'nt been updated, so it must be due to the change from Ubuntu 18.04 to
20.04. Some change to fetchmail and/or openssl?

Fetchmail version is release 6.4.2+GSS+NTLM+SDPS+SSL-SSLv2-SSLv3+NLS+KRB5.

The error from fetchmail is:

fetchmail: Server certificate verification error: EE certificate key too weak
fetchmail: OpenSSL reported: error:1416F086:
    SSL routines:tls_process_server_certificate:certificate verify failed
fetchmail: localhost: upgrade to TLS failed.

I can still ssh to the server and open the ssh tunnel.

I can even get round the error by adding '--nosslcertck' to the fetchmail call,
but this sounds a bit hacky (the man page says 'this is a disouraged option'
(sic)).

Can anyone inform me what the right thing to do is, Do I need extra options on
fetchmail, do I need to update a certificate, or modify my ssh config, or
something else?

Any hints very welcome.

Best, David McKelvie