forked from imapsync/imapsync
-
Notifications
You must be signed in to change notification settings - Fork 0
/
FAQ.SSL_errors.txt
133 lines (90 loc) · 4.8 KB
/
FAQ.SSL_errors.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
#!/bin/cat
$Id: FAQ.SSL_errors.txt,v 1.9 2019/12/11 15:38:37 gilles Exp gilles $
This document is also available online at
https://imapsync.lamiral.info/FAQ.d/
https://imapsync.lamiral.info/FAQ.d/FAQ.SSL_errors.txt
=======================================================================
Imapsync SSL errors
=======================================================================
Questions answered in this FAQ are:
Q. What are the errors
DEBUG: .../IO/Socket/SSL.pm:1165: local error: SSL write error
or
DEBUG: .../IO/Socket/SSL.pm:1088: local error: SSL read error
Q. What can I do to avoid those "SSL read/write errors"?
Q. SSL connect attempt failed SSL
routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
Now the questions again with their answers.
=======================================================================
Q. What are the errors
DEBUG: .../IO/Socket/SSL.pm:1165: local error: SSL write error
or
DEBUG: .../IO/Socket/SSL.pm:1088: local error: SSL read error
R1.Like they claim, those errors are SSL errors. SSL is not directly
done by imapsync but by an underlying Perl module called
IO::Socket::SSL. Those errors arise sometimes and sometimes
they form a serie that ends with imapsync auto-abortion.
Those errors happen with some hosts but not with others,
it's often Exchange or Office365. I don't know what exactly happens.
Those errors happen more often on Windows than on Linux.
=======================================================================
Q. What can I do to avoid those "SSL read/write errors"?
R0. Windows users: upgrade to imapsync.exe release 1.836 (or next ones)
Those errors don't appear with recent releases, post 1.836
R1. Remove all ssl/tls encryption
imapsync ... --nossl1 --notls1 --nossl2 --notls2
R2. If you don't want to quit encryption, rerun imapsync until the
complete sync is over. Those errors are not at the same place
each time, so imapsync will sync remaining messages at each run
until none remains.
R3. Run imapsync on a Linux machine, a VM is ok, there are less
SSL errors on Unix.
R4. Use https://imapsync.lamiral.info/X/
It's a Linux host so response R3 applies there.
R5. Set up a ssltunnel proxy to the host.
Read the file FAQ.Security.txt for an example to set up
a ssltunnel proxy.
=======================================================================
Q. SSL connect attempt failed SSL
routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
R1. Use:
imapsync ... --sslargs1 'SSL_cipher_list=DEFAULT'
or
imapsync ... --sslargs2 'SSL_cipher_list=DEFAULT'
depending on where the error occurs, host1 or host2 or both.
R2. If it doesn't work, I let you try other things,
I quote the "SSL_version" section of
https://metacpan.org/pod/IO::Socket::SSL (Module version: 2.066)
imapsync ... --sslargs1 SSL_version=SSLv2
imapsync ... --sslargs1 SSL_version=TLSv1_2
SSLv2 and TLSv12 are just examples depending on your context
(--ssl1 or --tls1, and also the imap server encryption scheme)
Feedback on what worked for you (and possibly hy) is welcome!
https://metacpan.org/pod/IO::Socket::SSL
...
SSL_version
Sets the version of the SSL protocol used to transmit data.
'SSLv23' uses a handshake compatible with SSL2.0, SSL3.0 and TLS1.x,
while 'SSLv2', 'SSLv3', 'TLSv1', 'TLSv1_1', 'TLSv1_2', or 'TLSv1_3'
restrict handshake and protocol to the specified version.
All values are case-insensitive. Instead of 'TLSv1_1', 'TLSv1_2', and 'TLSv1_3'
one can also use 'TLSv11', 'TLSv12', and 'TLSv13'.
Support for 'TLSv1_1', 'TLSv1_2', and 'TLSv1_3'
requires recent versions of Net::SSLeay and openssl.
Independent from the handshake format you can limit to set of
accepted SSL versions by adding !version separated by ':'.
The default SSL_version is 'SSLv23:!SSLv3:!SSLv2' which means,
that the handshake format is compatible to SSL2.0 and higher,
but that the successful handshake is limited to TLS1.0 and higher,
that is no SSL2.0 or SSL3.0 because both of these versions have
serious security issues and should not be used anymore.
You can also use !TLSv1_1 and !TLSv1_2 to
disable TLS versions 1.1 and 1.2 while still allowing TLS version 1.0.
Setting the version instead to 'TLSv1' might break interaction
with older clients, which need and SSL2.0 compatible handshake.
On the other side some clients just close the connection
when they receive a TLS version 1.1 request.
In this case setting the version
to 'SSLv23:!SSLv2:!SSLv3:!TLSv1_1:!TLSv1_2' might help.
=======================================================================
=======================================================================