Date: Mon, 11 May 2015 15:40:42 -0400 From: Jon Radel <jon@radel.com> To: freebsd-questions@freebsd.org Subject: Re: Certificate error Message-ID: <555105BA.4010702@radel.com> In-Reply-To: <5550C454.60202@gmail.com> References: <554FC878.7070401@gmail.com> <55501D92.2020102@radel.com> <5550C454.60202@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On 5/11/15 11:01 AM, Ernie Luzar wrote: > >>> >>> >>> fetchmail: Server certificate verification error: self signed >>> certificate >>> fetchmail: Missing trust anchor certificate: >>> >>> >> As a result, I'm kind of confused as to why fetchmail is complaining >> about a missing trust anchor for a self-signed certificate. But that >> does lead to the question: Did you install the CA certificate, >> CA.cert, where fetchmail will use it for verifying certificates? You >> should also realize that if you want to use your own CA, you're much >> better off not creating a new one willy-nilly, as you need to install >> the CA cert for every client which you want to actually verify the >> certificates signed by that CA. See >> http://lists.ccil.org/pipermail/fetchmail-friends/2006-April/010051.html >> for more. > Fetchmail is being used as a diagnostic tool. Fetchmail will follow > how a pop3 server is configured and in my case I am trying to test my > pop3 qpopper server for TLS. From the original post posted fetchmail > log you see that the pop3 server is offering STLS. This is what I am > expecting. Then the log shows the certs are missing a anchor point. Hence my question as to whether you installed the CA.cert for fetchmail. Which you appear to have not answered. Nor do you seem to have read the reference on the fetchmail mailing list that addresses how to either make fetchmail less picky about certificates or install the CA root certificate. > The posted cert build script is not some thing I pulled out of the air > or something I make up as a guess. Never said you were. I did point out that you were showing commands to sign a certificate with your own CA in an e-mail where you were complaining about being unable to get a self-signed certificate to work. If you're mixing and matching bits and pieces of different experiments in the same question, this rapidly becomes even more of a futile exercise than it already is. > I have a few different combinations of openssl command sequences form > different articles I read on the internet and all of them get the same > error. I just point qpopper to use the key & cert files made > separately by openssl commands. Yeah, but the last little bit of logging doesn't have qpopper the least bit upset so far as I can tell; it's got fetchmail upset. What does fetchmail have installed? > What sequence of openssl commands do you suggest I use? > Alas, alack, I find it hard to care; either type of certificate can be made to work with differing tradeoffs. Personally I simply use https://www.cacert.org when I need a free certificate in a place where I control the clients. But if you go that route, YOU STILL NEED TO INSTALL THE CA'S ROOT CERTIFICATES FOR FETCHMAIL! I would suggest you search for a tutorial on how TLS works that you're comfortable with and study it with care. In any case, this: > fetchmail: POP3< STLS > fetchmail: POP3< . > fetchmail: POP3> STLS > fetchmail: POP3< +OK STLS > fetchmail: Server certificate: > fetchmail: Issuer Organization: Powerman > fetchmail: Issuer CommonName: pop.powerman.com > fetchmail: Subject CommonName: pop.powerman.com > fetchmail: pop.a1poweruser.com key fingerprint: > 51:EC:3E:14:EA:E0:A9:97:1F:9F:D9:30:35:72:44:EA > > fetchmail: Server certificate verification error: self signed certificate > fetchmail: Missing trust anchor certificate: makes me think you may have a certificate installed just fine on qpopper and are simply ignoring that the default behavior of fetchmail is to be very picky about certificates. In other words, you may be abusing your diagnostic tool something terrible, and results with your actual client(s) may be completely different, depending on how they feel about using TLS for verification as opposed to for *only* encryption. Read http://www.fetchmail.info/fetchmail-FAQ.html#K5 for more. --Jon Radel jon@radel.com [-- Attachment #2 --] 0 *H 01 0 + 0 *H 00 #SanzTgk!0 *H 0o1 0 USE10U AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0 141222000000Z 200530104838Z01 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA0"0 *H 0 zSNpR V&IQZI`zQBy"aNv# J n=ٺ.CRC|2PȦOZϓ%{0dV*$3DiFK3@@:*S= a<UNv%!)|qvO_T{5R"=,0-1YR73i-C֥wgQ'뼥8v8ߌIs:2:=F:WtaP@?⟢! 00 U #0z4&&T$T0 U akᢠOg£ 0U 0U 0 0 U %0++0U 00U 0DU =0;09753http://crl.usertrust.com/AddTrustExternalCARoot.crl05+)0'0%+0http://ocsp.usertrust.com0 *H *nU:Uka+ #fjow^a } [jr AX&MX"cR6}Xޫ;cs{B#ʶM>K-ػBKiۦ74{:ǟO4ne6d)5ֱqC>2Svʆ4, Jؙ ␒ZBj#!eջ~ꌅ b:,Yř38z yJ&|00sT<}k `i 0 *H 01 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA0 150330000000Z 180329235959Z01 0 UUS10 U221501 0 UVA10U Springfield10U 6917 Ridgeway Dr.10U Jon T. Radel1200U )Issued through Jon T. Radel E-PKI Manager1 0 U Corporate Secure Email10U Jon Radel1 0 *H jon@radel.com0"0 *H 0 aЩ@@g3eGރ͛; d#>q7&Hf :3vL" jV#Xݷ>U-H[$SUڻ{Ϝ,z¶IchO=rcyr n v.Vh7k;%ueYuӬnz 6!| !Aȡ+,u+ CAպF-un#vjUJWnk%j] 2JPkl 00 U #0akᢠOg£ 0 U E|GDp/ʚB0U 0 U 0 0 U %0++0FU ?0=0; +10+0)+ https://secure.comodo.net/CPS0]U V0T0RPNLhttp://crl.comodoca.com/COMODOSHA256ClientAuthenticationandSecureEmailCA.crl0+00X+0Lhttp://crt.comodoca.com/COMODOSHA256ClientAuthenticationandSecureEmailCA.crt0$+0http://ocsp.comodoca.com0U 0 jon@radel.com0 *H KS `?H_D`8G߿ VbĘ<tB-Ӈї|{'Ũݹg0Gp$%F(;*MO*gt$@ t6,?0|#ăz,&! {j2i[%b7ߪP+9G㲍["y<?8rZ'[UR6%L̤ w"=:L~Ƨ^jf36 OP1.}(e110-001 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CAsT<}k `i 0 + U0 *H 1 *H 0 *H 1 150511194042Z0# *H 1 POX;础=bmT 0l *H 1_0]0 `He*0 `He0 *H 0*H 0 *H @0+0 *H (0 +71001 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CAsT<}k `i 0 *H 101 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CAsT<}k `i 0 *H KiNX _Z,#wHLpsҠ[a;hͿ& @N97h^X1%& [ Sܢyp qmŸ NÊ!ywϋ? jϡƮ|2"KvÉNWH \ a!g =yס5GXyo.+;lǺc* nM֖ӥܟt@`jt稊V pKZv 1?H
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?555105BA.4010702>