Re: [Evolution] Fatal TLS Alert

On Sat, 2018-11-03 at 21:13 -0400, Iain McVey via evolution-list wrote:
I just upgraded to Ubuntu 18.10 (Pop_OS! 18.10) so I now have Evolution
version 3.30.1-1 build1

I am getting the following error when I try connecting to my IMAP work
email account:

The reported error was “Failed to get capabilities: Peer sent fatal
TLS alert: Illegal parameter”.

I tried changing between TLS and STARTTLS, and connecting via port 143
(this is the one suggested in the IMAP server setup page) and also 993

these settings worked before the upgrade to 18.10.   And still work on
the gmail client on my phone.

I tried setting up the same account on geary, and claws.  Geary didn't
get th email, but didn't provide any useful feedback.  Claws showed the
same error.

Evolution (and presumably the others you mention) uses OpenSSL (I
think) for the encrypted links. I suspect that it's to do with the
upgrade of that rather than Evolution itself.  

When I set up this account on Thunderbird, I got a messages about the
sites certificate being from an unrecognized source, and did I want to
grant an exception.   When I granted the exception, thunderbird
conencted to the server and got my mail.

Thunderbird (like the other Mozilla products) are self contained so
don't rely on external libraries.

So, I am going on the assumption that the TLS problems with Evolution
might be casued by the dodgy certificate my employers email provider is

I looked around a bit, but couldn't find any means to tell Evolution to
trust a particular certificate.  Is this possible?  Can you point me to
some instructions?

Evolution will ask, but I suspect that's not the underlying problem.

There have been a lot of changes to what are considered to be secure
cyphers recently. The old insecure cyphers have been deprecated for a
while in OpenSSL. What I suspect is happening is that the group of
cyphers OpenSSL will use does not overlap with the cyphers offered by
your server. Specifically SSLv2 and TLSv1.0 are now considered to be
vulnerable.  You need to talk to your sysadmin to find out what cyphers
are offered by the server - if it doesn't offer SSLv3 or TLSv1.2 or
better then you are going to have problems. (I suspect that some would
SSLv3 also shouldn't be used.)


ps for the non British: s/cypher/cipher/

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]