CentOS - Oct 2007 - fetchmail log messages I don't understand

I see these messages every time fetchmail pops my mail.  I don't understand
what certificates it is talking about, or how to straighten this out.

fetchmail: Server CommonName mismatch: localhost != mail.mydomain.com
fetchmail: Server certificate verification error: self signed certificate
fetchmail: Server certificate verification error: certificate has expired

What do I need to read up on to understand this and find a fix?

TIA,
-chuck

On Wed, Oct 24, 2007 at 11:46:34AM -0500, Chuck Campbell
wrote:
> I see these messages every time fetchmail pops my mail.  I don't
understand
> what certificates it is talking about, or how to straighten this out.
A certificate identifies the server, i.e., the client gets a piece of
information about the server that can be used to start a private
conversation. The certificate must be signed by an entity, that you
trust.
> fetchmail: Server CommonName mismatch: localhost != mail.mydomain.com
The certificate was issued for the server: 'localhost', but you're
connecting to 'mail.mydomain.com'. This could be a man-in-the-middle
attack.
> fetchmail: Server certificate verification error: self signed certificate
The certificate is signed by itself, not by an external entity that you
trust. You can't be sure you're talking with the correct server.
> fetchmail: Server certificate verification error: certificate has expired
Every certificate has a validity (start and end date when the
certificate is valid). Yours has expired.
> What do I need to read up on to understand this and find a fix?
Public key infrastructure (PKI):

http://www.gtlib.cc.gatech.edu/pub/linux/docs/HOWTO/other-formats/html_single/SSL-Certificates-HOWTO.html
http://www.carillon.ca/library/howtos.php

-- 
lfr
0/0
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL:
<http://lists.centos.org/pipermail/centos/attachments/20071024/07d16aa8/attachment-0004.sig>

In article <20071024170332.GA9826 at bit.office.eurotux.com>,
Luciano Rocha <strange at nsk.no-ip.org> wrote:
> 
> On Wed, Oct 24, 2007 at 11:46:34AM -0500, Chuck Campbell wrote:
> > I see these messages every time fetchmail pops my mail.  I don't
understand
> > what certificates it is talking about, or how to straighten this out.
> 
> A certificate identifies the server, i.e., the client gets a piece of
> information about the server that can be used to start a private
> conversation. The certificate must be signed by an entity, that you
> trust.
> 
> > fetchmail: Server CommonName mismatch: localhost != mail.mydomain.com
> 
> The certificate was issued for the server: 'localhost', but
you're
> connecting to 'mail.mydomain.com'. This could be a
man-in-the-middle
> attack.
Or it could be a poorly set up mail server.
> > fetchmail: Server certificate verification error: self signed
certificate
> 
> The certificate is signed by itself, not by an external entity that you
> trust. You can't be sure you're talking with the correct server.
> 
> > fetchmail: Server certificate verification error: certificate has
expired
> 
> Every certificate has a validity (start and end date when the
> certificate is valid). Yours has expired.
Actually, it is not "your" certifiate. It is the certificate installed
on the mail server. It looks like the administrator of your mail server
has set it up with a test certificate issued to "localhost", signed by
itself, and which has now expired. They should instead purchase a
validated certificate from a certification authority.
> > What do I need to read up on to understand this and find a fix?
It's not something you can fix, except by getting your mail hosting
from another provider, or persuading your current provider to get
a proper certificate.

Cheers
Tony
-- 
Tony Mountifield
Work: tony at softins.co.uk - http://www.softins.co.uk
Play: tony at mountifield.org - http://tony.mountifield.org

On Wed, Oct 24, 2007 at 11:46:34AM -0500, Chuck Campbell
wrote:
> I see these messages every time fetchmail pops my mail.  I don't
understand
> what certificates it is talking about, or how to straighten this out.
> 
> fetchmail: Server CommonName mismatch: localhost != mail.mydomain.com
> fetchmail: Server certificate verification error: self signed certificate
> fetchmail: Server certificate verification error: certificate has expired
> 
> What do I need to read up on to understand this and find a fix?
I get messages like this with my fetchmail -- the cause has been either
the mail provider on the remote end is using a default, self-signed and
unmaintained
certificate (ie when you install Sendmail, you get some self-signed certs
generated that are useless beyond the scope of your own private use); in
other cases I have been referring to the computer by a name which differs from
that which the certificate was created with.

In this case I suspect a combination of the two.  It looks like the
service provider got a default cert set up with the system referring to
itself as 'localhost', which is naturally different form the name
'mail.mydomain.com' which is how you are referring to it.

In practice this is probably nothing to worry unduly about unless you
are paying extra for verified TLS-secured mail transmission.  The expired,
mismatched-name cert will be used to encrypt the mail transmission just as
well as a "proper" cert will.

-- 
 /\oo/\
/ /()\ \ David Mackintosh | 
         dave at xdroop.com  | http://www.xdroop.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL:
<http://lists.centos.org/pipermail/centos/attachments/20071024/27250721/attachment-0004.sig>