fetchmail ssl certificate verification problem in FreeBSD 8.1
carlj at peak.org
Tue Aug 31 00:42:39 UTC 2010
Dan Strick <mla_strick at att.net> writes:
> I just installed FreeBSD release 8.1 and rebuilt the fetchmail port.
> Now I get messages like these when I run fetchmail:
--- snip ---
> I can get rid of the message by removing the ssl option from the user
> line but then fetchmail would not even try to use ssl. Why would the
> old fetchmail be better able to verify the server's ssl certificate?
> Has openssl changed? Where is the openssl certificate directory and why
> should the information needed to verify the server's certificate be
> found on my machine? Doesn't the openssl library contain something
> like a hardwired list of well known certificate authority systems?
You already got replies about using the sslcertfile option pointing to
/usr/local/share/certs/ca-root-nss.crt. The problem is that only fixes
fetchmail and must be duplicated for each application. I finally got
around to looking into how to integrate those certificates into the
openssl configuration for FreeBSD, and the following is what I came up
The openssl configuration in /etc/ssl/openssl.cnf expects all
certificates and hashes to be in /etc/ssl/certs, so the certificate file
must be split into individual certificates there, and hashes generated.
The following steps will handle that. Some of these steps must be
performed as root, so all of them might as well be.
cd /etc/ssl/certs # create if necessary
split -p '^Certificate:' /usr/local/share/certs/ca-root-nss.crt cert
rm certaa # just the file header
for file in cert* ; do mv $file $file.pem ; done # rename to certxx.pem
perl /usr/src/crypto/openssl/tools/c_rehash . # generate the hashes
The above steps are for a FreeBSD 8.1-RELEASE, so they might not work
exactly for other versions. This also assumes that you trust the
certificates in the ca_root_nss package, so you will have to decide that
I have seen several questions and problems about ssl certificates, so
hopefully others will find this useful.
Carl Johnson carlj at peak.org
More information about the freebsd-questions