Emacs Stack Exchange is a question and answer site for those using, extending or developing Emacs. It only takes a minute to sign up.
Sign up to join this community
For the last two days, whenever I try to send an email, Emacs displays the following message:
The TLS connection to smtp.gmail.com:587 is insecure for the following reason:
* fingerprint has changed
I was unable to diagnose the problem after reading the relevant section of the manual or searching for answers online. My knowledge of network security is minimal, so I apologize if the solution is obvious.
Every secure connection is protected by encryption that relies on a pair of keys called the public key and the private key. The server that you are talking to sends its public key to your computer at the start of the connection so that your computer can use it during the encryption. The server decrypts everything using its private key, which is why the private key must remain private.
Additionally, every key pair is signed by a Certificate Authority. The server presents the certificate along with the public key, and your computer verifies the signature. It also verifies that the signature comes from a source that it trusts. The list of trusted sources is something that you can control, but most people just use the default list provided by their operating system or web browser. It is also possible for your employer to tamper with the list of trusted sources.
In your case, the error indicates that the signature is valid and from a trusted source, but that the public key is not the same as the public key that Emacs expected to see. Three days ago when Emacs connected to the server the key was A, but today it is B. A and B are different, so Emacs is concerned. Because keys are rather large, we humans usually only compare fingerprints, which are just fixed–length hashes of the keys.
This is a sign that your connection to the server might have been hijacked by a malicious party. But at the same time, it could just be that the owner of the server has recently started using a new key pair. The signatures on the certificates do expire, and it is not uncommon to install a completely new key pair at the same time you install a new certificate.
Emacs is asking you to decide whether it is really safe to connect to the server or not. Emacs stores key fingerprints in ~/.emacs.d/network-security.data by default, though you can change that by modifying the nsm-settings-file variable.
It is up to you to decide if it is safe to proceed or not, but I will point out that merely hijacking the connection usually results in a failure to verify the certificate. To avoid this, the hijacker would need to convince a Certificate Authority to issue a valid certificate for a domain that the hijacker does not control, and any Certificate Authority that was caught doing this would be removed as a trusted source and would go out of business. It has happened before though, so it’s certainly not impossible. Because the certificate is both valid and signed by a trusted source, a hijacked connection seems unlikely.
However, recall that your employer could have modified the list of trusted sources. Some companies use “security” products that hijack all secure connections in order to scan them for threats, and to avoid the attention of their employees they add themselves to the list of trusted certificate sources. In principle, anyone with access to your computer, or any software that you have run on it, could have modified the list of trusted certificates.
If you decide that it is safe, then you can remove the fingerprint for that server from the nsm-settings-file and Emacs will save the new fingerprint in its place.
