Re: new (?) version of the old nnml problem

[Eric Abrahamsen <eric@ericabrahamsen.net>]

Emanuel Berg <moasen@zoho.com> writes:

> Eric Abrahamsen wrote:
>
>> Maybe confirm that POP access works from the
>> command line first?
>>
>> https://unix.stackexchange.com/questions/201818/checking-pop-mail-account-using-terminal
>
> Error according to socat, works with openssl.
>
> test-zoho () {
>     local server=pop.zoho.com
>     local port=995
>     socat - OPENSSL:${server}:${port}
>     echo "socat done"
>     openssl s_client -quiet -connect ${server}:${port}
>     echo "openssl done"
> }
>
> $ test-zoho
>
>     2017/10/20 17:54:09 socat[29967] E SSL_connect(): error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
>     socat done
>     depth=2 C = US, O = "thawte, Inc.", OU = Certification Services Division, OU = "(c) 2006 thawte, Inc. - For authorized use only", CN = thawte Primary Root CA
>     verify return:1
>     depth=1 C = US, O = "thawte, Inc.", OU = Domain Validated SSL, CN = thawte DV SSL CA - G2
>     verify return:1
>     depth=0 CN = *.zoho.com
>     verify return:1
>     +OK POP3 mx.zohomail.com v1.0 server ready <10427.1508514850321@mx.zohomail.com>
>     user XYZ
>     +OK
>     pass ABC
>     +OK
>     quit
>     +OK mx.zohomail.com Service closing transmission channel
>     openssl done

Unfortunately I don't know too much about tls, and will be of limited
help here, but my guess is there's something slightly wrong with the
pop.zoho.com certificate, something that openssl is letting slide, but
socat and gnutls aren't happy about.

I really don't know much about these issues, though, so hopefully
someone else will jump in...

Eric