SSL fingerprints mailserver
I use fetchmail to pull down my mail from the mailserver, just now the ssl fingerprints changed
leading to an error like:
fetchmail: <mailserver> fingerprints do not match!
12096:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:../../../../common/openssl/ssl/s3_clnt.c:894:
fetchmail: SSL connection failed.
fetchmail: socket error while fetching from <userid>@<mailserver>
fetchmail: Query status=2 (SOCKET)
So to get the new fingerprint, firstly get the changed ssl cert:
openssl s_client -connect <mailserver>:<port> -showcerts
and copy say the first cert to a file <mailserver>.pem. Now generate
the SSL fingerprint of this pem file:
openssl x509 -fingerprint -md5 -noout -in <mailserver>.pem
MD5 Fingerprint=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
and put it in the .fetchmailrc file:
poll <mailserver> protocol imap port <port>
username <userid>
ssl sslfingerprint XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
sslcertpath /path/to/certs
Whew, nice and quick, thanks to google 🙂
viaSSL fingerprints mailserver : SMG’s Weblog.