Re: [Fetchmail-users] Using fetchmail with iCloud via IMAP

[Matthias A. <mat...@gm...>]

Am 12.03.22 um 08:47 schrieb Jon Brinkmann:
> Without the certificates extracted from the output of the command:
>
> 	openssl s_client -connect imap.mail.me.com:993 -showcerts
>
> or with the Mozilla root certificates, available from
>
> 	https://curl.se/[...]
>
> fetchmail says:
>
> 	fetchmail: Server certificate verification error: self signed certificate in certificate chain
> 	fetchmail: Missing trust anchor certificate: /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
> 	fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details.

Jon,

stop random trying - it wastes everybody's time - and go systematically.

Disregard random stuff you find on the Internet. It is not usually
written for your distribution or distribution's version or file layout
and may not be complete - see above. Forget -showcerts. It is a
debugging tool for knowledgeable developers, not for end users.

Read and understand the error message and the referenced information.

Look for and install Mozilla's root certificates PER YOUR DISTRIBUTION'S
PACKAGE. Find out how it's called if it is not ca-certificates nor
ca-certificates-mozilla nor ca_root_nss.

Also see:
>   https://...

No. I don't care for even more distraction, because there is no need.
imap.mail.me.com validates properly for me, out of the box, on Fedora
Linux 35, on Ubuntu 20.04.4, on Alpine Linux 3.15, and on FreeBSD 13.0.
I have tried all four just now.

> $ fetchmail -vcNd0 -f/dev/null imap.mail.me.com -pimap --ssl --user joe
> Enter password for jo...@im...:
> fetchmail: --check mode enabled, not fetching mail
> fetchmail: 6.4.28 querying imap.mail.me.com (protocol IMAP) at Sat, 12
> Mar 2022 20:34:10 +0000 (UTC): poll started
> Trying to connect to 17.42.251.32/993...connected.
> fetchmail: Server certificate:
> fetchmail: Issuer Organization: Apple Inc.
> fetchmail: Issuer CommonName: Apple Public Server RSA CA 12 - G1
> fetchmail: Subject CommonName: imap.mail.me.com
> fetchmail: Subject Alternative Name: p41-imap.mail.me.com
> [...]
> fetchmail: Subject Alternative Name: p28-imap.mail.me.com
> fetchmail: Subject Alternative Name: imap.mail.me.com
> fetchmail: Subject Alternative Name: p80-imap.mail.me.com
> fetchmail: Subject Alternative Name: p33-imap.mail.me.com
> fetchmail: Subject Alternative Name: p59-imap.mail.me.com
> fetchmail: Subject Alternative Name: p72-imap.mail.me.com
> fetchmail: Subject Alternative Name: mail.mac.com
> fetchmail: imap.mail.me.com key fingerprint:
> D8:37:66:9C:66:58:51:20:BB:0F:28:B1:68:F3:0A:F9
> fetchmail: SSL/TLS: using protocol TLSv1.3, cipher
> TLS_AES_256_GCM_SHA384, 256/256 secret/processed bits
> fetchmail: IMAP< * OK [CAPABILITY XAPPLEPUSHSERVICE IMAP4 IMAP4rev1
> SASL-IR AUTH=ATOKEN AUTH=PLAIN] (2210B49-fcb7e75610a7)
> st43p00im-tygg09060401.me.com
> fetchmail: will idle after poll
> [...]