Pages: 1
RSS
TLS and sertificate failure
 
Bat 4.2.36.4 and before that the previous v 4.2.xx.x on WinXP.
Wierd problem appeared when sending emails. I got error below when trying to send:
Code
2010-05-19, 23:42:07: SEND  - sending mail message(s) - 1 message(s) in queue
2010-05-19, 23:42:09: SEND  - Initiating TLS handshake
>2010-05-19, 23:42:09: SEND  - Certificate S/N: 4B210292, algorithm: RSA (1024 bits), issued fr om 5/5/2010 3:11:53 PM to 3/12/2011 3:41:49 PM, for 1 host(s): webmail.ihostexchange.net.
>2010-05-19, 23:42:09: SEND  - Owner: CA, Quebec, Sherbrooke, Solutions Sherweb Inc., SherWeb, webmail.ihostexchange.net.
>2010-05-19, 23:42:09: SEND  - Issuer: US, "Entrust, Inc.", www.entrust.net/rpa is incorporated by reference, "(c) 2009 Entrust, Inc.", Entrust Certification Authority - L1C.
!2010-05-19, 23:42:09: SEND  - TLS handshake failure. The server host name ("smtp.ihostexchange.net") does not match the certificate.
2010-05-19, 23:42:09: SEND  - connection finished - 0 message(s) sent
2010-05-19, 23:42:09: SEND  - Some messages were not sent - check the log for details

I browsed thru Bat options and found that this message appear when "Options->Smime & TLS->S/mime Engine" is set to Microsoft CryptoAPI. When I change it to "Internal implementation" there's still error message in log (below) but it's became possible to send mail after cliking OK on security warning about sertificate.
[IMG]http://img163.imageshack.us/img163/7874/post1249672053.gif[/IMG]
http://img163.imageshack.us/img163/7874/post1249672053.gif

Code
2010-05-19, 23:51:13: SEND  - sending mail message(s) - 1 message(s) in queue
2010-05-19, 23:51:15: SEND  - Initiating TLS handshake
>2010-05-19, 23:51:15: SEND  - Certificate S/N: 4B210292, algorithm: RSA (1024 bits), issued fr om 5/5/2010 3:11:53 PM to 3/12/2011 3:41:49 PM, for 10 host(s): webmail.ihostexchange.net, smtp.ihostexchange.net, autodiscover.ihostexchange.net, webim.ihostexchange.net, ocsweb.ihostexchange.net, sip.ihostexchange.net, webconf.ihostexchange.net, As.webim.ihostexchange.net, download.webim.ihostexchange.net, avedge.ihostexchange.net.
>2010-05-19, 23:51:15: SEND  - Owner: CA, Quebec, Sherbrooke, Solutions Sherweb Inc., SherWeb, webmail.ihostexchange.net.
>2010-05-19, 23:51:15: SEND  - Issuer: US, Entrust, Inc., www.entrust.net/rpa is incorporated by reference, (c) 2009 Entrust, Inc., Entrust Certification Authority - L1C.
>2010-05-19, 23:51:15: SEND  - Issuer: Entrust.net, www.entrust.net/CPS_2048 incorp. by ref. (lim its liab.), (c) 1999 Entrust.net Lim ited, Entrust.net Certification Authority (2048).
!2010-05-19, 23:51:15: SEND  - TLS handshake failure. Invalid server certificate (The issuer of this certificate chain was not found).
2010-05-19, 23:51:17: SEND  - TLS handshake complete
2010-05-19, 23:51:17: SEND  - connected to SMTP server
2010-05-19, 23:51:17: SEND  - sending message to xxxxx@xxxxx.xxx and others


I believe that this is The Bat bug. I don't think that Sherweb which is pretty serious company has wrong sertificate. You can see in the second message that sertificate actually include smtp.ihostexchange.net.
Or at least is there any way to get rid of this annoying confirmation window? Somehow "add to trusted" or something like this.
 
It means that TB doesn't know the company that isuued the certificate.
When a stranger tells you that some other stranger is the king of Spain, then it's up to you to believe him or not. Basically it's the same here. TB tells you that stranger one tells you that stranger two is your designated host.
The way to tell TB (and other programs) that stranger one reaaly can be trusted is by importing their root certificate.
It's been a while since I needed that, but IIRC the way to do that was by importing the root certificate via the Internet Explorer and then configure it as a trusted root. You should be able to download that root certicate somewhere from  http://www.entrust.net/developer/index.cfm
__________________________________
I'm just a user of The Bat! I don't work for Ritlabs.
 
Roelof Otten
Thank you for the idea and link. Importing certificates thru IE didn't actually help. But importing sertificate thru Bat address book (like described here) worked. At least it send and receive with no warning while i have "Internal implementation" as "S/mime Engine". "Microsoft CryptoAPI" is still broken.
Pages: 1