Ubuntu
prayer package

  1. Disco (19.04)
  2. Bug #1834340
  3. Comment #4

Comment 4 for bug 1834340

Revision history for this message
David Zuelke (dzuelke) wrote : Re: Possible regression on libssl upgrade when using TLSv1.3

Here's a patch.

Before, when connecting to GMail IMAP with PHP:

root@39f3acd3838c:/app# php -r 'imap_open("{imap.gmail.com:993/imap/ssl}INBOX", "user", "pass") or die(imap_last_error());'

Warning: imap_open(): Couldn't open stream {imap.googlemail.com:993/imap/ssl}INBOX in /app/imap.php on line 6
Certificate failure for imap.googlemail.com: self signed certificate: /OU=No SNI provided; please fix your client./CN=invalid2.invalid

After the patch (the auth error is correct for those credentials obviously):

root@00b5d649f707:/app# php -r 'imap_open("{imap.gmail.com:993/imap/ssl}INBOX", "user", "pass") or die(imap_last_error());'

Warning: imap_open(): Couldn't open stream {imap.googlemail.com:993/imap/ssl}INBOX in /app/imap.php on line 5
Can not authenticate to IMAP server: [AUTHENTICATIONFAILED] Invalid credentials (Failure)

There is a similar patch at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916041, but that uses an OpenSSL version check instead of the IMO better #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME