Re: IMAP/SSL with gnus

[Alexander Kotelnikov <sacha@giotto.sj.ru>]

>>>>> On Thu, 08 Aug 2002 01:00:07 +0200
>>>>> "SJ" == Simon Josefsson <jas@extundo.com> wrote:
SJ> 
SJ> Alexander Kotelnikov <sacha@giotto.sj.ru> writes:
>>>>>>> On Wed, 07 Aug 2002 18:34:50 +0200
>>>>>>> "SJ" == Simon Josefsson <jas@extundo.com> wrote:
SJ> 
SJ> Alexander Kotelnikov <sacha@giotto.sj.ru> writes:
>>>> How do I force gnus to ask me, if I accept SSL sertificate from imap
>>>> server?
SJ> 
SJ> Look into ssl.el, in particular `ssl-certificate-verification-policy'.
SJ> Interactivity and prompting is poor.  The builtin TLS support would
SJ> have help.
>> 
>> I have
>> (imap-ssl-program (quote ("openssl s_client -ssl3 -connect %s:%p")))
>> (ssl-certificate-verification-policy 3) ; reject on fail
>> (ssl-program-arguments (quote ("s_client" "-host" host "-port" service "-verify" (int-to-string ssl-certificate-verification-policy) "-CApath" ssl-certificate-directory)))
>> And gnus do not ask my, if I would like to accept a certificate.
SJ> 
SJ> Hm, it seems to be unimplemented.  ssl-accept-ca-certificate prompts
SJ> the user, but it isn't called from anywhere.
SJ> 
SJ> Do you need to be prompted?  Simply installing your CA so that OpenSSL
SJ> finds it should be enough, I think.  With "reject on fail", you can't
SJ> login unless the server certificate verifies correctly, so it is
SJ> almost like a prompt. :-)

I do not see any other way to avoid IP spoofing with successive
password grabbing.

May be to switch to (nnimap-stream shell) with ssh, but it do not work
for me, may be some tweaking is needed.

-- 
Alexander Kotelnikov
Saint-Petersburg, Russia