2

We're in the process of changing mail servers. The new one will require a client certificate from our internal CA for all connections. How can I make gnus use a client certificate in the connection? I can't find any option for that in the nnimap documentation.

I tried setting it up like this:

(setq gnus-secondary-select-methods '(
                  (nnimap "imap"
                      (nnimap-address "imap.example.com")
                      (nnimap-server-port 993)
                      (nnimap-stream ssl)
                      (nnimap-inbox "INBOX")
                      (nnimap-split-methods default)
                      )
                  ))

and with the authinfo entry

machine imap.example.com  port imaps key "~/.privat/certs/jenny.key" cert "~/.privat/certs/jenny.pem"

When I try to connect, I get the following errors in emacs:

Opening nnimap server on imap...
Opening connection to imap.example.com via tls...
auth-source-search: found 1 backends matching (:max 1 :host ("imap.example.com" "imap") :port (993 "imaps" "imap" "993" "143") :user nil :require (:user :secret) :create t)
auth-source-search: found 0 results (max 1) matching (:max 1 :host ("imap.example.com" "imap") :port (993 "imaps" "imap" "993" "143") :user nil :require (:user :secret) :create t)
auth-source-search: found 1 backends matching (:max 1 :host ("imap.example.com" "imap") :port (993 "imaps" "imap" "993" "143"))
auth-source-search: found 0 results (max 1) matching (:max 1 :host ("imap.example.com" "imap") :port (993 "imaps" "imap" "993" "143"))
auth-source-search-backend: got 1 (max 1) in netrc:~/.authnfo-test matching (:max 1 :host ("imap.example.com" "imap") :port (993 "imaps" "imap" "993" "143") :user nil :require (:user :secret) :create t)
auth-source-search: CREATED 1 results (max 1) matching (:max 1 :host ("imap.example.com" "imap") :port (993 "imaps" "imap" "993" "143") :user nil :require (:user :secret) :create t)
Opening nnimap server on imap...failed: NO (ALERT) Client didn't present valid SSL certificate

The mailserver also says no certificate was presented:

Dec 12 11:10:22 imap dovecot: imap-login: Disconnected (client didn't send a cert):
Improve this question
2
  • That 'CREATED' means auth-source didn't find a match. From the debug I think that the authinfo entry needs a 'login' field as well. ('password' it should prompt for).
    – rpluim
    Dec 12, 2018 at 12:06
  • And if the authentication required by the server is only cert based, not username/password based, then I think changes would be required in nnimap.el
    – rpluim
    Dec 12, 2018 at 12:15

1 Answer 1

Reset to default
1

I took the shortcut of using openssl for the SSL connection:

(setq gnus-secondary-select-methods '(
                      (nnimap "post"
                          (nnimap-address "post.example.se")
                          (nnimap-server-port 993)
                          (nnimap-stream shell)
                          (nnimap-shell-program "openssl s_client -host post.example.se -port 993 -key /home/jenny/.privat/certs/jenny.key -cert /home/jenny/.privat/certs/jenny.pem -CAfile /home/jenny/.privat/certs/ExampleServerCertificateAuthority.pem")
                          (nnimap-inbox "INBOX")
                          (nnimap-split-methods default)
                          )
                      ))

Note that the upcoming emacs-27 has support for using key and cert specifications from auth-source automatically, so that the builtin GnuTLS support will work in place of the external tools.

Improve this answer
5
  • Ugh. In theory you should be able to specify the client certificate to use via auth-source, which should then cause the default underlying open-network-stream to pass that to the builtin TLS functions, but I can't see an actual implementation of that in auth-source.el. Might be worth asking on emacs-devel.
    – rpluim
    Dec 11, 2018 at 13:30
  • I'm blind. The following type of.authinfo entry should work: machine post.example.se port 993 key "~/.my_smtp_tls.key" cert "~/.my_smtp_tls.cert"
    – rpluim
    Dec 11, 2018 at 13:39
  • @rpluim Thanks for the suggestion - I didn't even consider authinfo. But I didn't get it to work with authinfo; I turned on àuth-debug trivia` and I could see that it used the correct line, but the server says that no certifiate was presented. (I agree with your ugh about this solution, though!)
    – Jenny D
    Dec 11, 2018 at 14:10
  • Could you update your question to show what your nnimap select method looks like now? If it's not using the builtin GNUTls things won't work.
    – rpluim
    Dec 11, 2018 at 15:19
  • @rpluim I've updated it now.
    – Jenny D
    Dec 12, 2018 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.