OfflineIMAPS and CA certificates

Question

This question is about offlineimaps but with the given opportunity I'd like resources to learn more about ssl certificates and the whole deal with them.

I downloaded the latest offlineimaps (7.0.6) and after I was done with the minimal config I run the command and I get the following error:

Account sync Gmail:
 *** Processing account Gmail
 Establishing connection to imaps://imap.gmail.com:993 (GmailRemote)
 ERROR: No CA certificates and no server fingerprints configured.  You must configure at least something, otherwise having SSL helps nothing.
 *** Finished account 'Gmail' in 0:00
ERROR: Exceptions occurred during the run!
ERROR: No CA certificates and no server fingerprints configured.  You must configure at least something, otherwise having SSL helps nothing.

Traceback:
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/accounts.py", line 271, in syncrunner
    self.__sync()
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/accounts.py", line 334, in __sync
    remoterepos.getfolders()
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/repository/IMAP.py", line 448, in getfolders
    imapobj = self.imapserver.acquireconnection()
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/imapserver.py", line 511, in acquireconnection
    af=self.af,
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/imaplibutil.py", line 194, in __init__
    super(WrappedIMAP4_SSL, self).__init__(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/bundled_imaplib2.py", line 2135, in __init__
    IMAP4.__init__(self, host, port, debug, debug_file, identifier, timeout, debug_buf_lvl)
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/bundled_imaplib2.py", line 357, in __init__
    self.open(host, port)
  File "/usr/local/lib/python2.7/dist-packages/offlineimap/imaplibutil.py", line 201, in open
    "having SSL helps nothing.", OfflineImapError.ERROR.REPO)

I want to download all mail from my gmail account, and later figure out how to read it with mutt. But first all I want to do is have a folder with all my mail in it.

Here is my .offlineimaprc

[general]
accounts = Gmail

[Account Gmail]
localrepository = GmailLocal
remoterepository = GmailRemote
ssl = yes
synclabels = yes

[Repository GmailLocal]
type = Maildir
localfolders = ~/Mail/Gmail

[Repository GmailRemote]
type = IMAP
remotehost = imaps://imap.gmail.com
remoteuser = [MY_E-MAIL]@gmail.com

score 9 · Accepted Answer · answered Jul 03 '17 at 05:47

9

At some point in the not-too-distant-past, offlineimap started verifying SSL certificates (yes, it wasn't before apparently). Rather than do the sensible thing, and use the default system trust store by default, you need to manually configure each remote repository to point to a list of certificates. On Debian/Ubuntu systems, the following setting in the Repository GmailRemote should do the trick:

sslcacertfile = /etc/ssl/certs/ca-certificates.crt

On other systems, the file may be in a different place; a web search should find details as to where the trust store is kept.

answered Jul 03 '17 at 05:47

womble

378
4
10

Thanks for the answer, I can't confirm it works because I now use mbsync (isync) witch I find is easier to set up and use. I'll accepted it because it seems that it solves the problem – The Gramm Jul 04 '17 at 11:23
I've tested it and can confirm that it works. I am using Ubuntu, which uses the same location as debian. – mc0e Sep 24 '18 at 06:01

OfflineIMAPS and CA certificates

1 Answers1