tls certificate for alpine email client

shep · #1 **(View Single Post)** 21st September 2016

On 6.0amd64 release, my new email server uses a tls certificate but I'm having difficulty setting it up properly.

Apparently mail/alpine is not using the system wide certificates in /etc/ssl/cert.pem. I get the following message when I start alpine

Code:

unable to get local issuer certificate (details)

The details

Code:

Host given by user:

  mail.centurylink.net

Reason for failure:

  unable to get local issuer certificate

Certificate being verified:

  /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5

There is an option to bypass the certificate with

Code:

 mail.centurylink.net/novalidate-cert

which I view as short cut.

Ideally, I would either like to have alpine use the system wide certifcates or use locally use the certificates I fetched for my mutt configuration ~/.config/mutt/certificates/certs

Code:

I grep'd one of the lines in the above certificate against /etc/ssl/cert.pem and did not get a match. I'm guessing it is missing.

Alpine has the following certificate options

Code:

# Public certificates are kept in files in this directory. The files should
# contain certificates in PEM format. The name of each file should look
# like <emailaddress>.crt. The default directory is .alpine-smime/public.
smime-public-cert-directory=

# If this option is set then public certificates are kept in a single container
# "file" similar to a remote configuration file instead of in the
# smime-publiccert-directory. The value can be a remote or local folder
# specification like for a non-standard pinerc value. The default
# is that it is not set.
smime-public-cert-container=/etc/ssl/cert.pem

# Private keys are kept in files in this directory. The files are in PEM format.
# The name of a file should look like <emailaddress>.key.
# The default directory is .alpine-smime/private.
smime-private-key-directory=

# If this option is set then private keys are kept in a single container
# "file" similar to a remote configuration file instead of in the
# private-key-directory. The value can be a remote or local folder
# specification like for a non-standard pinerc value. The default
# is that it is not set.
smime-private-key-container=

# Certificate Authority certificates (in addition to the normal CACerts for the
# system) are kept in files in this directory. The files are in PEM format.
# Filenames should end with .crt. The default directory is .alpine-smime/ca.
smime-cacert-directory=

# If this option is set then CAcerts are kept in a single container
# "file" similar to a remote configuration file instead of in the
# ca-cert-directory. The value can be a remote or local folder
# specification like for a non-standard pinerc value. The default
# is that it is not set.
smime-cacert-container=

I wonder why the centurylink certificates were not included and am leaning towards using the certificates in a ~/ file. Any suggestions on setting a local public file for alpine?

Edit:
I found this widely referenced pine-ssl link and tried setting up a /etc/ssl/certs/ directory and making a ~/.alpine-smime/ca/centurylink_tls.crt but still get the local certificate failure.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
alpine with .pine-passfile support	slowtechstef	OpenBSD Packages and Ports	3	26th February 2016 10:30 PM
Alpine Linux	J65nko	Other BSD and UNIX/UNIX-like	5	3rd July 2015 01:12 PM
Alpine (.pinerc) configuration help	cssgalactic	FreeBSD General	1	1st March 2011 05:26 AM
OBSD client hangs mounting NFS; Linux client doesn't	amorphousone	OpenBSD General	7	26th August 2010 05:21 AM
Alpine not working	tomageeni	OpenBSD General	7	2nd April 2010 10:06 PM