On Tue, 27 Aug 2002 07:56:38 +0000 (UTC), Ole Michaelsen
<omic+usenet4@fys.ku.dk> wrote:
>> Jeg forsøger at få en pop3s op at køre med stunnel (3.22) og qmail's
>> pop3 daemon. Jeg starter den op med:
>
>[...]
>
>> A Certificate chain processed correctly, but terminated in a root
>> certificate which is not trusted by the trust provider.
>>
>> Do you want to continue using this server ?"
>>
>> Hvordan pokker undgår jeg dette ?? Certifikatet er sign'ed af
>> GlobalSign, så det skulle/burde da ikke være årsag til problemet...
>
>Proev en 'openssl s_client -connect din-pop3s-server.domaene:995
>-prexit' for at blive sikker paa om du vitterligt ser det rigtige
>certifikat.
Ikke at jeg bliver meget klogere af det, outputtet er nedenfor.... Er
der noget galt med den måde jeg har skruet /etc/ssl/stunnel.pem filen
sammen på ?? Dele af outputtet er redigeret/klippet af
anonymitets-hensyn
/Brian
CONNECTED(00000003)
depth=0 /C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
i:/C=BE/O=GlobalSign nv-sa/OU=Secure Server CA/CN=GlobalSign Secure
Server CA
1 s:/C=BE/O=GlobalSign nv-sa/OU=Primary Secure Server
CA/CN=GlobalSign Primary Secure Server CA
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
2 s:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
[snip]
-----END CERTIFICATE-----
subject=/C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
issuer=/C=BE/O=GlobalSign nv-sa/OU=Secure Server CA/CN=GlobalSign
Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 2729 bytes and written 314 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 1024 bit
SSL-Session:
Protocol : TLSv1
Cipher : DES-CBC3-SHA
Session-ID:
D2F39EF27C34B6B048DC1737F90A1DABD24B48CD8A65B4A835C10844F6823BE3
Session-ID-ctx:
Master-Key:
BB3ACED42E2FBE0C61914F2088A31C060591B9E8B220CC0BFC91611ED93EFF17674BFA37423FDE8C530F077B6CBA207C
Key-Arg : None
Start Time: 1030464590
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
+OK <30013.1030464591@mail.xxx.dk>
quit
+OK
closed
---
Certificate chain
0 s:/C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
i:/C=BE/O=GlobalSign nv-sa/OU=Secure Server CA/CN=GlobalSign Secure
Server CA
1 s:/C=BE/O=GlobalSign nv-sa/OU=Primary Secure Server
CA/CN=GlobalSign Primary Secure Server CA
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
2 s:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
[snip]
-----END CERTIFICATE-----
subject=/C=DK/L=Copenhagen/O=xxx/OU=System
Operations/CN=pop3s.xxx.dk/Email=hostmaster@xxx.dk
issuer=/C=BE/O=GlobalSign nv-sa/OU=Secure Server CA/CN=GlobalSign
Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 2872 bytes and written 380 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 1024 bit
SSL-Session:
Protocol : TLSv1
Cipher : DES-CBC3-SHA
Session-ID:
D2F39EF27C34B6B048DC1737F90A1DABD24B48CD8A65B4A835C10844F6823BE3
Session-ID-ctx:
Master-Key:
BB3ACED42E2FBE0C61914F2088A31C060591B9E8B220CC0BFC91611ED93EFF17674BFA37423FDE8C530F077B6CBA207C
Key-Arg : None
Start Time: 1030464590
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---