[Bug] Server Certificate not checked when sending emails [answered]

asked 2016-10-23 10:39:10 +0300

ghling

4414 ●58 ●89 ●96

updated 2016-10-25 16:12:33 +0300

jiit

2678 ●32 ●58 ●59

admin

I'm using a (officially untrusted) CA to issue self-signed certificates for my servers, including my mail server. To be able to get a secure connection (aka not need to enable the "Accept untrusted certificates" option in the accounts server settings), I exchanged the ca-bundle of the mail application (in the file /etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem ) so it only contains the cert of my CA.

At first, this went as expected and allowed me to connect to my mail server with the mail application accepting the self-signed certificates. After upgrading to the 2.0.4-EA, the new Certificate Tool ins Settings showed me, that only my CA is listed in the ca-bundle for mails (though, I downgraded back to 2.0.2 in the meantime).

Now to the issue: I'm not using my own server for sending mails, but the smtp server of my provider (with StartTLS), which obviously is not using a certificate signed by my CA, but from an official CA (which should not be trusted based on my mail ca-bundle as mentioned above). Nevertheless, I can send mails without problems, so the mail application does not seem to check the certificate of the outgoing server against the ca-bundle for mails. This can have multiple causes:

I'm missing something in my considerations (e.g. edited the wrong file)
The application is using a different ca-bundle to check outgoing servers (which would be unexpected behavior from my point of view)
The application is not checking certificates at all in this scenario (which would be really bad)

Can someone please look into this and point me to my error or confirm this bug?

Thank you already.

edit retag flag offensive reopen delete

The question has been closed for the following reason "the question is answered, an answer was accepted" by ghling
close date 2016-10-24 15:35:51.865540

answered 2016-10-24 15:18:36 +0300

ghling

4414 ●58 ●89 ●96

Well, this is a bit embarrassing, but it seems that I misinterpreted the file names. After the update to 2.0.4.14, which shows the system certificates inside the Settings menu, the tasks of the different ca-bundle files becomes much clearer for me:

email-ca-bundle.pem does not specify which CAs are trusted for checking certificates of mail servers, but to check the validity of email signatures (probably like S-MIME stuff).

The actual certificate of the mail server seems to be checked against the main ca-bundle (which is much more coherently called "TLS Connections" in the new Settings menu), which seems to include my CA as well (probably the success of my earlier attempts to include it).

I'm terrible sorry if I caused some confusion, as the problem actually was on my side.

Comments

If your problem is solved you may close your question as answered. :)

Alex ( 2016-10-24 15:34:06 +0300 )edit

Thanks for the hint, I thought marking the answer as correct was sufficient. Fixed now.

ghling ( 2016-10-24 15:36:56 +0300 )edit

[Bug] Server Certificate not checked when sending emails [answered]

The question has been closed for the following reason "the question is answered, an answer was accepted" by ghling
close date 2016-10-24 15:35:51.865540

1 Answer

Comments

Question tools

Stats

Related questions

[Bug] Server Certificate not checked when sending emails [answered]

The question has been closed for the following reason "the question is answered, an answer was accepted" by ghling close date 2016-10-24 15:35:51.865540

1 Answer

Comments

Question tools

Public thread

Stats

Related questions

The question has been closed for the following reason "the question is answered, an answer was accepted" by ghling
close date 2016-10-24 15:35:51.865540