On Sunday, 21 January 2024 16:09:47 GMT Walter Dnes wrote: > On Sun, Jan 21, 2024 at 12:05:45PM +0000, Michael wrote > > > Anyway, to take you forward you can: [snip ...]
> Nothing above works, and I wonder if it's something at my end. I keep > getting the same message... > > > gnutls_handshake: A packet with illegal or unsupported version was > > received. > The current net-libs/gnutls-3.8.0 ebuild (and 3.8.1 and 3.8.2) has > sslv2 and sslv3 enabled in IUSE ...but... "emerge -pv gnutls" shows > them hard-masked. Is my system forcing sslv1 and the server rejecting me??? > > [ebuild R ] net-libs/gnutls-3.8.0:0/30.30::gentoo USE="cxx idn nls > openssl seccomp tls-heartbeat tools zlib -brotli -dane -doc -examples > -pkcs11 (-sslv2) (-sslv3) -static-libs -test (-test-full) -verify-sig > -zstd" 0 KiB > > Do you get the same? Do I have to set something in... > > make menuconfig > -*- Cryptographic API ---> > > "emerge -pv mutt" > > [ebuild R ] mail-client/mutt-2.2.12::gentoo USE="debug gnutls gpgme > hcache imap lmdb mbox nls pop sasl smtp ssl -autocrypt -berkdb -doc -gdbm > -gsasl -idn -kerberos -pgp-classic (-prefix) -qdbm (-selinux) -slang > -smime-classic -tokyocabinet -vanilla" 0 KiB > > I copied certificates from x.txt to .mutt/certificates (see > attachment). Is this correct? And how do I securely pass credentials? Starting from the end; to securely pass credentials you need an encrypted connection to the server. For SMTP server authentication this normally takes place using STARTTLS on port 587, or explicit TLS typically on port 465 or port 25 depending on your mail provider. Your locally stored certificate chain should be in multiple .pem files, one for each certificate. Normally only the Root CA is needed since this was used to sign all its children certificates in the chain. In the first instance just store in your ~/.mutt/certificates/ directory the Root CA certificate, to see if mutt accepts it without gnutls complaining. In your attachment you have 4 certificates: 1. The certificate used by the SMTP server (a wildcard ebox.ca domain certificate): Subject: CN = *.ebox.ca which is issued by "CN = Go Daddy Secure Certificate Authority - G2". 2. The "Go Daddy Secure Certificate Authority - G2" was in turn issued by "CN = Go Daddy Root Certificate Authority - G2". 3. The "CN = Go Daddy Root Certificate Authority - G2" was issued by "OU = Go Daddy Class 2 Certification Authority". 4. Finally, the last certificate "OU = Go Daddy Class 2 Certification Authority" is the self-signed Root CA. This is the certificate you could copy into your ~/.mutt/certificates/. A copy of this certificate should be available in your /etc/ssl/certs/, so you could copy it and also hash it: cp /etc/ssl/certs/Go_Daddy_Class_2_CA.pem ~/.mutt/certificates/ cd ~/.mutt/certificates/ ln -s Go_Daddy_Class_2_CA.pem `openssl x509 -hash -noout -in Go_Daddy_Class_2_CA.pem`.0 Please note the backticks in the above. If this still won't work, have you considered ditching gnutls on mutt and trying with vanilla openssl? $ emerge -pv mutt These are the packages that would be merged, in order: Calculating dependencies... done! Dependency resolution took 23.29 s (backtrack: 0/20). [ebuild N ] mail-client/mutt-2.2.12::gentoo USE="gdbm hcache imap lmdb nls sasl smtp ssl -autocrypt -berkdb -debug -doc -gnutls -gpgme -gsasl -idn - kerberos -mbox -pgp-classic -pop (-prefix) -qdbm (-selinux) -slang -smime- classic -tokyocabinet -vanilla" 5432 KiB $ emerge -pv gnutls These are the packages that would be merged, in order: Calculating dependencies... done! Dependency resolution took 1.45 s (backtrack: 0/20). [ebuild R ] net-libs/gnutls-3.8.0:0/30.30::gentoo USE="cxx idn nls openssl seccomp tls-heartbeat zlib -brotli -dane -doc -examples -pkcs11 (- sslv2) (-sslv3) -static-libs -test (-test-full) -tools -verify-sig -zstd" ABI_X86="(64) -32 (-x32)" 0 KiB It may be the openssl is more accommodating for Root CAs using SHA1 and will allow the connection to complete.
signature.asc
Description: This is a digitally signed message part.
