offlineimap and ssl requires configuration of fingerprint

[Scott Moser]

Upon upgrade from 12.04 to quantal, my offlineimap configuration broke, showing messages like:

| *** Processing account Gmail
| INFO:OfflineImap:*** Processing account Gmailu
| Establishing connection to imap.gmail.com:993
| INFO:OfflineImap:Establishing connection to imap.gmail.com:993
| ERROR: Server SSL fingerprint 'f3043dd689a2e7dddfbef82703a6c65ea9b634c1'
| for hostname 'imap.gmail.com' does not match configured fingerprint.
| Please verify and set 'cert_fingerprint' accordingly if not set yet.
| INFO:OfflineImap:ERROR: Server SSL fingerprint 'f3043dd689a2e7dddfbef82703a6c65ea9b634c1'
| for hostname 'imap.gmail.com' does not match configured fingerprint.
| Please verify and set 'cert_fingerprint' accordingly if not set yet.

The fix is for the user to add an entry for 'cert_fingerprint' in the same spot as 'ssl = yes' (which is automatic if 'type = Gmail').
Ie add:
 cert_fingerprint = f3043dd689a2e7dddfbef82703a6c65ea9b634c1

So that your Repository entry looks something like:
| [Repository GmailRemote]
| type = Gmail
| # ssl = yes # this is default for gmail
| cert_fingerprint = f3043dd689a2e7dddfbef82703a6c65ea9b634c1
| remoteuser = <email address hidden>

There is some discussion at http://comments.gmane.org/gmane.mail.imap.offlineimap.general/5654 about possibly using system certificates to make such manual configuration unnecessary.

This bug is filed upstream at:
 https://github.com/spaetz/offlineimap/issues/46

ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: offlineimap 6.5.4-2
ProcVersionSignature: Ubuntu 3.4.0-5.11-generic 3.4.0
Uname: Linux 3.4.0-5-generic x86_64
ApportVersion: 2.2.3-0ubuntu6
Architecture: amd64
Date: Wed Jun 20 12:50:06 2012
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
PackageArchitecture: all
ProcEnviron:
 TERM=xterm
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: offlineimap
UpgradeStatus: Upgraded to quantal on 2011-11-07 (226 days ago)

[Scott Moser (smoser)]

I see 2 ways to make the situation better:
 a.) help upstream use system certificates if that is not already functional and build debian package so that works
 b.) improve the error messages in the case where there is no entry for the Repository to be something more useful like:
  | The server for repository 'Gmail' has a fingerprint that cannot be
  | verified. If you trust the fingerprint of
  | 'f3043dd689a2e7dddfbef82703a6c65ea9b634c1' then you need to update the
  | 'Repository Gmail' entry in offlineimaprc to include:
  | ssl = yes
  | cert_fingerprint = f3043dd689a2e7dddfbef82703a6c65ea9b634c1

'a' is definitely useful, but I suspect will not fix the issue for everyone.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Michael Vogt (mvo)]

This is one way of solving the issue by providing a default setting for the sslcasert file that points to the ubuntu systemwide
/etc/ssl/certs/ca-certificates.crt file

[Rafał Ochmański (rmopl)]

You can add

sslcacertfile = /etc/ssl/certs/ca-certificates.crt

in the [Repository remote] section.

[Mihai Capotă (mihaic)]

I successfully tested the solution in the patch from comment #4 on Ubuntu 14.04.