Problems accessing IMAP with TLS

Problems accessing IMAP with TLS

[Timo Myyrä]

Hi,

I'm trying to access my schools Exchange 2010 IMAP server from Gnus but I
can't get secure connection to it.

I can access the IMAP server with plain IMAP and plaintext password just fine
but obviously this isn't good option security-wise. 

The school instruction tells to use the IMAP service with port 143 and TLS
enabled.

I've tested the instructions with Thunderbird and I had to use STARTTLS
instead of SSL/TSL for connection security for the connection to succeed.

I have following settings but it won't work.
(setq gnus-select-method '(nnimap "metropolia"
                                  (nnimap-address "195.148.166.20")
                                  (nnimap-server-port 143)
                                  (nnimap-stream starttls)))

When trying above settings I get following to Messages buffer:
imap: Connecting to 195.148.166.20...
Opening STARTTLS connection to `195.148.166.20:143'...done
imap: Connecting with STARTTLS...
STARTTLS negotiation failed: *** Starting TLS handshake
- Certificate type: X.509
 - Got a certificate list of 1 certificates.
 - Certificate[0] info:
  - subject `C=FI,ST=Uusimaa,L=Helsinki,O=Metropolia AMK,OU=Tietohallinto,\
CN=mail.metropolia.fi', issuer `DC=root,DC=amk,DC=pk,CN=pk-PK\
DC01-CA', RSA key 2048 bits, signed using RSA-SHA,\
activated `2010-05-10 07:00:28 UTC', expires `2012-05-09 07:00:28 UTC',\
SHA-1 fingerprint `86003ab3a460ed46c57be01834ea2db13145952f'
- The hostname in the certificate does NOT match '195.148.166.20'

Process imap<1> exited abnormally with code 1

The schools instructions told to accept the certificate warning but I don't
know how to do it with Gnus and that seems to be the problem here.

Any idea how to get the connection to function properly?

Re: Problems accessing IMAP with TLS

[Gijs Hillenius]

On  2 Sep 2010, Timo Myyrä wrote:

[...]

> - The hostname in the certificate does NOT match '195.148.166.20'

[...]

> Any idea how to get the connection to function properly?

Add this to your set-up in .gnus

 starttls-extra-arguments '("--insecure")