[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
This bug was fixed in the package isync - 1.3.0-1ubuntu0.18.04.0 --- isync (1.3.0-1ubuntu0.18.04.0) bionic; urgency=medium * Cheerypick 1.3.0-2 patch to use SNI when connecting with SSL. LP: #1812667 -- Dimitri John Ledkov Fri, 14 Dec 2018 15:35:09 +1100 ** Changed in: isync (Ubuntu Bionic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
This bug was fixed in the package isync - 1.3.0-1ubuntu0.18.10.0 --- isync (1.3.0-1ubuntu0.18.10.0) cosmic; urgency=medium * Cheerypick 1.3.0-2 patch to use SNI when connecting with SSL. LP: #1812667 -- Dimitri John Ledkov Fri, 14 Dec 2018 15:35:09 +1100 ** Changed in: isync (Ubuntu Cosmic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
** Tags added: id-5c6152a1705f317c2d2dc663 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
Using sample config from e.g. https://wiki.archlinux.org/index.php/Isync ubuntu@enormous-maggot:~$ grep VERSION /etc/os-release VERSION="18.10 (Cosmic Cuttlefish)" VERSION_ID="18.10" VERSION_CODENAME=cosmic ubuntu@enormous-maggot:~$ dpkg-query -W isync isync 1.3.0-1build1 (reverse-i-search)`isy': sudo apt install ^Cync/cosmic ubuntu@enormous-maggot:~$ mbsync -V -l gmail -c test-mbsyncrc -a Reading configuration file /home/ubuntu/.mbsyncrc No channel or group named '-c' defined. No channel or group named 'test-mbsyncrc' defined. No channel or group named '-a' defined. Channel gmail Opening master store gmail-remote... Resolving imap.gmail.com... ok Connecting to imap.gmail.com (74.125.133.109:993)... Opening slave store gmail-local... SSL error connecting imap.gmail.com (74.125.133.109:993): self signed certificate Upgrading to: $ dpkg-query -W isync isync 1.3.0-1ubuntu0.18.10.0 $ mbsync -V -l gmail -c test-mbsyncrc -a Reading configuration file /home/ubuntu/.mbsyncrc No channel or group named '-c' defined. No channel or group named 'test-mbsyncrc' defined. No channel or group named '-a' defined. Channel gmail Opening master store gmail-remote... Resolving imap.gmail.com... ok Connecting to imap.gmail.com (74.125.133.109:993)... Opening slave store gmail-local... Connection is now encrypted Logging in... Authenticating with SASL mechanism PLAIN... IMAP command 'AUTHENTICATE PLAIN ' returned an error: NO [AUTHENTICATIONFAILED] Invalid credentials (Failure) And "connection is now encrypted" -> ssl coonection is established meaning SNI is now used correctly, and the (on purpose) invalid password is rejected by remote server. ** Tags removed: verification-needed-cosmic ** Tags added: verification-done-cosmic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
Bionic now: $ dpkg-query -W isync libssl1.1 isync 1.3.0-1ubuntu0.18.04.0 libssl1.1:amd64 1.1.1-1ubuntu2.1~18.04.0 $ mbsync -V -l gmail -c test-mbsyncrc -a Reading configuration file /home/ubuntu/.mbsyncrc No channel or group named '-c' defined. No channel or group named 'test-mbsyncrc' defined. No channel or group named '-a' defined. Channel gmail Opening master store gmail-remote... Resolving imap.gmail.com... ok Connecting to imap.gmail.com (74.125.133.108:993)... Opening slave store gmail-local... Connection is now encrypted Logging in... Authenticating with SASL mechanism PLAIN... again, encrypted connection is established now. ** Tags removed: verification-needed verification-needed-bionic ** Tags added: verification-done verification-done-bionic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
Hello Daniel, or anyone else affected, Accepted isync into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/isync/1.3.0-1ubuntu0.18.04.0 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: isync (Ubuntu Bionic) Status: In Progress => Fix Committed ** Tags added: verification-needed-bionic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
Hello Daniel, or anyone else affected, Accepted isync into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/isync/1.3.0-1ubuntu0.18.10.0 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: isync (Ubuntu Cosmic) Status: In Progress => Fix Committed ** Tags added: verification-needed verification-needed-cosmic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
** Description changed: [Impact] * OpenSSL 1.1.1 performs SNI hostname verification, therefore hostname SSL context option must be set when establishing the connection, otherwise, validation of SNI certificates fail and thus resulting in lack of connectivity. [Test Case] * use isync to connect to an SNI tls protected host, e.g. imap.gmail.com [Regression Potential] * change is compatible with openssl versions shipped in bionic/cosmic-release * change is from upstream / tested in debian & disco * change improves security, and is compatible with deployed servers out there * hosts with certificates not matching their actual hostname will remain invalid/untrusted + [Additional info] + To install python & openssl 1.1.1 on Bionic you may enable and use the below silo, which will then exhibit the enforcement of SNI hostname verification. + + sudo add-apt-repository ppa:ci-train-ppa-service/3473 + sudo apt-get update + [Other Info] * original bug report Hi, I just upgraded to cosmic and have hit the issue described in debian bug #9065955 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906955 - mbsync won't connect to e.g. gmail because of SSL errors. I downloaded 1.3.0-2 from Debian and it works. Would it be possible to backport the fix to Cosmic please? Bionic is unaffected. Regards, Daniel -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
** Changed in: isync (Debian) Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1812667] Re: Can't verify some ssl certificates (e.g. imap.gmail.com)
Bionic will be affected, when OpenSSL 1.1.1 is SRUed into Bionic via https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1797386 ** Also affects: isync (Ubuntu Cosmic) Importance: Undecided Status: New ** Also affects: isync (Ubuntu Bionic) Importance: Undecided Status: New ** Description changed: + [Impact] + + * OpenSSL 1.1.1 performs SNI hostname verification, therefore hostname + SSL context option must be set when establishing the connection, + otherwise, validation of SNI certificates fail and thus resulting in + lack of connectivity. + + [Test Case] + + * use isync to connect to an SNI tls protected host, e.g. + imap.gmail.com + + [Regression Potential] + + * change is compatible with python versions shipped in bionic-release + * change is from upstream / tested in debian & disco + * change improves security, and is compatible with deployed servers out there + * hosts with certificates not matching their actual hostname will remain invalid/untrusted + + [Other Info] + + * original bug report + Hi, I just upgraded to cosmic and have hit the issue described in debian bug #9065955 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906955 - mbsync won't connect to e.g. gmail because of SSL errors. I downloaded 1.3.0-2 from Debian and it works. Would it be possible to backport the fix to Cosmic please? Bionic is unaffected. Regards, Daniel ** Bug watch added: Debian Bug tracker #906955 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906955 ** Also affects: isync (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906955 Importance: Unknown Status: Unknown ** Changed in: isync (Ubuntu) Status: New => Fix Released ** Changed in: isync (Ubuntu Bionic) Status: New => In Progress ** Changed in: isync (Ubuntu Cosmic) Status: New => In Progress ** Description changed: [Impact] - * OpenSSL 1.1.1 performs SNI hostname verification, therefore hostname + * OpenSSL 1.1.1 performs SNI hostname verification, therefore hostname SSL context option must be set when establishing the connection, otherwise, validation of SNI certificates fail and thus resulting in lack of connectivity. [Test Case] - * use isync to connect to an SNI tls protected host, e.g. + * use isync to connect to an SNI tls protected host, e.g. imap.gmail.com [Regression Potential] - * change is compatible with python versions shipped in bionic-release - * change is from upstream / tested in debian & disco - * change improves security, and is compatible with deployed servers out there - * hosts with certificates not matching their actual hostname will remain invalid/untrusted + * change is compatible with openssl versions shipped in bionic/cosmic-release + * change is from upstream / tested in debian & disco + * change improves security, and is compatible with deployed servers out there + * hosts with certificates not matching their actual hostname will remain invalid/untrusted [Other Info] - - * original bug report + + * original bug report Hi, I just upgraded to cosmic and have hit the issue described in debian bug #9065955 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906955 - mbsync won't connect to e.g. gmail because of SSL errors. I downloaded 1.3.0-2 from Debian and it works. Would it be possible to backport the fix to Cosmic please? Bionic is unaffected. Regards, Daniel -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1812667 Title: Can't verify some ssl certificates (e.g. imap.gmail.com) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isync/+bug/1812667/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
