I’m trying to set up the reply by email feature, but am getting these errors in the logs: Job exception: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed /usr/local/lib/ruby/2.0.0/net/pop.rb:552:in `connect' /usr/local/lib/ruby/2.0.0/net/pop.rb:552:in `do_start' /usr/local/lib/ruby/2.0.0/net/pop.rb:530:in `start' /var/www/discourse/app/jobs/scheduled/poll_mailbox.rb:88:in `poll_pop3' /var/www/discourse/app/jobs/scheduled/poll_mailbox.rb:18:in `execute' /var/www/discourse/app/jobs/base.rb:153:in `block (2 levels) in perform' current_db: default current_hostname: metaruby.com job: Jobs::PollMailbox problem_db: default hostname: my.host.com-app process_id: 76 opts: I have a self signed cert, but SMTP on the same server/domain is working fine - any ideas why this might be happening?

WHOOO HOOOOO! It’s working!! (Self signed) Some things to note: In the code in the post above (15) the certificate has to be named .crt (and not .cert!) The hostname when creating the self signed cert should not have ‘www’ in it. The pop3 polling host in the Discourse control panel should just have the hostname (so not mail.domain.com, just domain.com). I do have other problems tho :mask: RateLimiter::LimitExceeded but at least we’ve moved on a bit! Hope this thread proves useful for others too :slight_smile:

Coming back to this question: Is there a reason a free SSL certificate from someone like StartSSL wouldn’t work?

Personally I would prefer to use my own self-signed cert.

Self-signed is going to be a world of hurt. Not sure if we can even help you if you willingly opt in to the extreme pain scenario.

I seem to be making some progress… the only error I’m getting now is: Job exception: SSL_connect returned=1 errno=0 state=unknown state: unknown protocol With backtrace: /usr/local/lib/ruby/2.0.0/net/pop.rb:552:in `connect' /usr/local/lib/ruby/2.0.0/net/pop.rb:552:in `do_start' /usr/local/lib/ruby/2.0.0/net/pop.rb:530:in `start' /var/www/discourse/app/jobs/scheduled/poll_mailbox.rb:91:in `poll_pop3' /var/www/discourse/app/jobs/scheduled/poll_mailbox.rb:18:in `execute' /var/www/discourse/app/jobs/base.rb:153:in `block (2 levels) in perform' That seems to point to this: http://stackoverflow.com/questions/17369962/opensslsslsslerror-ssl-connect-returned-1-errno-0-state-unknown-state-unkn with the three options being: So the indicated approaches seem to be: Upgrade the server to handle more Client Hello variants, or Install a ruby that uses an older OpenSSL library, or Change your program to send a different Client Hello. I think in the interest of keeping barriers low for Discourse, 1 and 2 would not be ideal options. Do you have any ideas which CH Discourse uses? And whether it would be feasible to add another (that is perhaps more widely compatible or helps make things more widely compatible)? Edit: I guess I’d still be having this problem even if I got a free SSL cert as this is a protocol miss-match. Should I start a dedicated topic for it?

Ok I think I’ve found the solution @downey @riking @codinghorror :slight_smile: Just need to add a site setting pop3 polling ssl verify none Then update this code: from: def poll_pop3 connection = Net::POP3.new(SiteSetting.pop3_polling_host, SiteSetting.pop3_polling_port) connection.enable_ssl if SiteSetting.pop3_polling_ssl connection.start(SiteSetting.pop3_polling_username, SiteSetting.pop3_polling_password) do |pop| unless pop.mails.empty? pop.each do |mail| handle_mail(mail) end end pop.finish end rescue Net::POPAuthenticationError => e Discourse.handle_job_exception(e, error_context(@args, "Signing in to poll incoming email")) end to: def poll_pop3 connection = Net::POP3.new(SiteSetting.pop3_polling_host, SiteSetting.pop3_polling_port) if SiteSetting.pop3_polling_ssl if SiteSetting.pop3_polling_ssl_verify_none connection.enable_ssl(OpenSSL::SSL::VERIFY_NONE) else connection.enable_ssl end end connection.start(SiteSetting.pop3_polling_username, SiteSetting.pop3_polling_password) do |pop| unless pop.mails.empty? pop.each do |mail| handle_mail(mail) end end pop.finish end rescue Net::POPAuthenticationError => e Discourse.handle_job_exception(e, error_context(@args, "Signing in to poll incoming email")) end If this is ok, and if someone can point me in the right direction of how to add the site setting I can send a PR (but quite happy for one of you guys to do it instead as that’d be quicker.)

[图片] I really dislike the concept of disabling ssl verification, its mega risky and defeats the purpose of having SSL. Not sure this is a good idea. As I’ve been saying.

We already have the option for SMTP: DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: 'none' We also have the option to turn off SSL with POP: Use SSL while connecting to the POP3 server. (Recommended) So this has to be better than that right? Why not just let admins decide? Discourse wins as it brings the barrier down - not having to get paid (or free) SSL certs, getting additional IPs (not free with most hosts), setting everything up etc

Stop scaring me :scream_cat: Is the only risk the server getting hacked and the key stolen? Wouldn’t you just generate another certificate? Or am I missing something? (Admittedly I do not know much about it, apart from that I have used self-signed certs for years without any problems). (Also I think the situations are different - Sam is posting in a thread about CAS - what is that? An external auth of some sort? I think this is different as it is your own server which you have hopefully secured). Edit 1: If you’d rather it not be in the Admin Control Panel, why not just add it as an option in app.yml like the current SMTP one? That way the only people who use it will be those who really want to. Edit 2. This is an interesting read which suggests they are not all that bad after all.. Edit 3: To make things easier, it’d probably be true that if the user has set SMTP verify to none the same will most likely apply to POP, so the code could be changed to: if SiteSetting.pop3_polling_ssl if GlobalSetting.smtp_openssl_verify_mode == 'none' connection.enable_ssl(OpenSSL::SSL::VERIFY_NONE) else connection.enable_ssl end end

As long as you don’t implement some kind of verification (only allowing specific certificates), disabling verification makes the certificate almost worthless. You know that your traffic is encrypted, but not with whom you’re communicating. With the settings you recommend, any active network attacker can easily man-in-the-middle the connection by presenting another self-signed certificate he created himself.

Reply by email SSL self signed certificate error

Product Support

codinghorror (Jeff Atwood) 2015 年8 月 11 日 23:19 21

Not sure this is a good idea. As I’ve been saying.

话题		回复	浏览量
Use a self-signed cert with Discourse for emails Sysadmins email , how-to	0	3237	2015 年8 月 12 日
Email Hostname Certificate Mismatch Causing sidekiq Queue Overload, Severe Site Instability Self-hosting	63	6699	2023 年9 月 28 日
Ya estoy cansado, he instalado discourse en varios VPS ninguno me funcionan Self-hosting	36	927	2026 年8 月 6 日
Email not working (SSL_connect returned=1) Self-hosting	15	2918	2022 年6 月 15 日
Postfix mailing fails Self-hosting	17	1972	2019 年2 月 2 日

Reply by email SSL self signed certificate error

相关话题