[CentOS] Mystery of email authentication

Sat Dec 24 02:34:25 UTC 2011
Timothy Murphy <gayleard at eircom.net>

I'm trying to setup sendmail/dovecot on a new server running CentOS-6
(well, CentOS-6.2 now).
Everything seems to go well, but when I run fetchmail I get this warning:
------------------------------------
[tim at grover ~]$ fetchmail imap.maths.tcd.ie
fetchmail: Warning: the connection is insecure, continuing anyways. (Better 
use --sslcertck!)
------------------------------------

I should say that everything runs fine on a CentOS-5.7 server,
and as far as I can see the setup on the new server is the same.
Under CentOS-5.7 I don't get the same warning:
------------------------------------
[tim at helen ~]$ fetchmail imap.maths.tcd.ie
fetchmail: No mail for tim at imap.maths.tcd.ie
------------------------------------

If I do add --sslcertck (as suggested) I get the response:
------------------------------------
[tim at grover ~]$ fetchmail --sslcertck imap.maths.tcd.ie
fetchmail: Server certificate verification error: self signed certificate
fetchmail: This means that the root signing certificate (issued for 
/C=IE/ST=Dublin/L=Dublin/O=School of Mathematics, Trinity College, 
Dublin./OU=Automatically-generated IMAP SSL 
key/CN=imap.maths.tcd.ie/emailAddress=postmaster at maths.tcd.ie) is not in the 
trusted CA certificate locations, or that c_rehash needs to be run on the 
certificate directory. For details, please see the documentation of --
sslcertpath and --sslcertfile in the manual page.
139925738739528:error:14090086:SSL 
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify 
failed:s3_clnt.c:1063:
fetchmail: SSL connection failed.
fetchmail: socket error while fetching from tim at imap.maths.tcd.ie
fetchmail: Query status=2 (SOCKET)
------------------------------------
That is on the new server.
On the old server (where the fetchmail command works)
I get much the same warning, though briefer.
------------------------------------
[tim at helen ~]$ fetchmail --sslcertck imap.maths.tcd.ie
fetchmail: Server certificate verification error: self signed certificate
11316:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate 
verify failed:s3_clnt.c:915:
fetchmail: SSL connection failed.
fetchmail: socket error while fetching from tim at imap.maths.tcd.ie
fetchmail: Query status=2 (SOCKET)
------------------------------------

I must admit I've never been very clear on SSL authentication


-- 
Timothy Murphy  
e-mail: gayleard /at/ eircom.net
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College Dublin