[SOLVED] make mbysnc ignore/accept bad SSL certificate

Trilby · 2015-11-16 16:23:24

I've been using mbysnc for syncing my mail. But my employer's mail server started giving errors this past week due to a faulty SSL certificate. They will not fix it, and they will not care. They only support MS Outlook running on Windows.

To even access my mail via the outlook web thing I need to accept the bad certificate in my browser (which was done only after a bit of investigation).

I also figured out how to accept the faulty certificate on my android phone: I re-entered incoming server info, then when prompted with the warning I selected "Accept Anyway" or some such.

I cannot, however, find the equivalent for mbsync. I just get the following error:

$ mbsync umassmed
C: 0/1  B: 0/1  M: +0/0 *0/0 #0/0  S: +0/0 *0/0 #0/0
SSL error connecting mail.umassmed.edu (146.189.216.100:993): error:00000014:lib(0):func(0):SSL lib
C: 1/1  B: 0/1  M: +0/0 *0/0 #0/0  S: +0/0 *0/0 #0/0mbsync: socket.c:738: do_write: Assertion `sock->fd >= 0' failed.
Aborted (core dumped)

Is there any way to get mbsync to accept the certificate?

I see there is a section on the wiki here that seems relevant, but those instructions seem outdated: I was able to get the server's current .pem file, but there are no required files included in the ca-certificates package for the second step to convert the .pem to .crt.

I did try using openssl to convert the .pem to a .crt directly, and while this did produce a result, the resulting .crt file produced the same error when I added it to my .mbsyncrc.

Last edited by Trilby (2015-11-21 00:34:23)

Trilby · 2015-11-21 00:38:22

I figured this out through a bit of random flailing starting with one part I was missing before `sudo trust extract-compat`.

After that I had *.pem files in /etc/ (not .crt, but perhaps they are equivalent - I have no idea). But then I could use openssl as described in the wiki to retrieve the current server certificate, check the alleged signer, copy the relevant root certificate to ~/.cert, and rehash. Then - and this point seems to be missing from the wiki - I had to replace the generic *.crt file in my mbsyncrc with the new server .pem file in ~/.cert.

If anyone understands any of this, perhaps you could update the wiki. I now have my mail working, but I have no idea why these steps worked, nor do I really know what they did - so I can't really add them to the wiki.

Arch Linux

#1 2015-11-16 16:23:24

[SOLVED] make mbysnc ignore/accept bad SSL certificate

#2 2015-11-21 00:38:22

Re: [SOLVED] make mbysnc ignore/accept bad SSL certificate

Board footer