I was using stunnel with a self-signed certificate.
Recently a update of stunnel forbids self-signed certificates, so I bought a valid certificate from namecheap, to use it with apache an stunnel.
And Tested from a remote machine with fetchmail to get mail using POP3S.
It gets it but with a warning
[FONT=monospace]unable to get local issuer certificate
fetchmail: Broken certification chain at: /C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Domain Validation Secure Server CA
fetchmail: This could mean that the server did not provide the intermediate CA's certificate(s), which is nothing fetchmail could do anything about. For details, please see the
README.SSL-SERVER document that ships with fetchmail.
fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. Fo
r details, please see the documentation of --sslcertpath and --sslcertfile in the manual page.
unable to verify the first certificate
fetchmail: Warning: the connection is insecure, continuing anyways. (Better use --sslcertck!)
[/FONT]
I have run c_rehash but id did not work.
As fethmail returns the fingerprint of the server, I have added a sslfingerprint option in .fetchmailrc and it stops complaining, so I can use it, but i would like to know what is going wrong. Do I need to add some certificate to /etc/ssl/certs in the client?
The file should contain t**he whole certificate chain **starting from the actual server/client certificate, and ending with the ... **root CA certificate**.
Client certificates are normally signed with intermediate certificates which are refreshed rather frequently. To verify client certificate it is necessary to follow its chain up to root certificate. Either you need to manually install each intermediate certificate on fetchmail system or you should put full chain in stunnel configuration.
“Sectigo RSA Domain Validation Secure Server CA” is intermediate certificate used to sign domain name certificates. It itself is signed by “USERTrust RSA Certification Authority” which is present in the list of trusted root CA. You need both to verify certificate issued to you.
Recently a update of stunnel forbids self-signed certificates
Care to elaborate? I see nothing in stunnel documentation, rather it explicitly explains in several places how to use self-signed certificate.
I have changed to the old self-signed key and restarted stunnel. I don think the error is the same it was before (it was two months or more ago, and I have kept an old release of stunnel since then until now I have upgraded to the last version) but there is a error
How to secure your WordPress Multisite instance using SSL.
Simply put ssl stands for Secure Sockets Layer with the new standard called Transport Layer Security. So, what is it and why do you need/want to use it? Read on to learn all about SSL and WordPress multisite SSL
You can install SSL in yourWordPress