BorlandTalk.com

Darryl Strickland · Guest

When using OpenSSL to connect to an email server via IMAP and SMTP are
certificates required? I have tried with implicitTLS and explicitTLS and
every possible combination but none is reliable.

Thanks
Darryl

Eugene Mayevski · Guest

Hello!
You wrote on Thu, 24 Aug 2006 14:43:22 -0400:

DS> When using OpenSSL to connect to an email server via IMAP and SMTP are
DS> certificates required? I have tried with implicitTLS and explicitTLS
DS> and every possible combination but none is reliable.

The question is not really openssl-specific, but about TLS. Server-side
certificates are required to authenticate the server. There exist anonymous
cipher suites for TLS, but this doesn't make much sense. Client-side
certificates *may* be required by the server to authenticate the client.
Presense of this requirement depends on the actual server setup.

With best regards,
Eugene Mayevski

Darryl Strickland · Guest

Eugene,
Thanks for the answer. What I'm trying to figure out is why ssl connects
some of the time and others it fails to this mail server. When it fails I
have received the TLS Handshake error and other times no meaning full
errors. Any ideas? I'm using the latest build of Indy with Openssl but I
had the same results with an earlier 10x version of Indy and Indy openssl
before upgraded a couple of days ago

Thanks
Darryl

Eugene Mayevski wrote:

Eugene Mayevski · Guest

Hello!
You wrote on Thu, 24 Aug 2006 15:32:21 -0400:

DS> Thanks for the answer. What I'm trying to figure out is why ssl
DS> connects some of the time and others it fails to this mail server.
DS> When it fails I have received the TLS Handshake error and other times
DS> no meaning full errors.

Is it the same server each time? Frankly speaking I didn't work with OpenSSL
(our developers did), but you can use SecureBlackbox 5 beta
(http://www.eldos.com/sbb/download.php) and it's TElSimpleSMTPClient to do
the tests. At least you will get the detailed error report and will be able
to diagnose the problem.

With best regards,
Eugene Mayevski

Remy Lebeau (TeamB) · Guest

"Darryl Strickland" <dstrickland (AT) integratedconsole (DOT) com> wrote in message
news:44edf2cd$1 (AT) newsgroups (DOT) borland.com...

Remy Lebeau (TeamB) · Guest

"Darryl Strickland" <dstrickland (AT) integratedconsole (DOT) com> wrote in message
news:44edfe48 (AT) newsgroups (DOT) borland.com...

Darryl Strickland · Guest

This is how I'm creating the Id components to use with OpenSSL. I have
tried all the SSLOption combination but this works the best but still fails
50% of the time. If the main thread it works about 75% of the time but in
background threads about 50% but sometimes fails every time.

I've tried every combination of these three settings.

SSLOptions.Method := sslvTLSv1;
SSLOptions.Mode := sslmBoth;
SSLOptions.VerifyMode := [sslvrfClientOnce];

Here's the code:

var
IdUserPassProvider1: TIdUserPassProvider;
IdSSLIOHandlerSocketOpenSSLSmtp: TIdSSLIOHandlerSocketOpenSSL;
IdSASLLogin1: TIdSASLLogin;
IdSASLCRAMMD51: TIdSASLCRAMMD5;
IdSASLAnonymous1: TIdSASLAnonymous;
TheSMTP: TIdSMTP;
begin

IdUserPassProvider1 := TIdUserPassProvider.Create(Self);
with IdUserPassProvider1 do
begin
Password := frmMain.YourPassword;
Username := frmMain.YourAccount;
end;

IdSSLIOHandlerSocketOpenSSLSmtp :=
TIdSSLIOHandlerSocketOpenSSL.Create(Self);
with IdSSLIOHandlerSocketOpenSSLSmtp do
begin
Destination := 'smtp.onebox.com:465';
Host := 'smtp.onebox.com';
Port := 465;
DefaultPort := 0;
SSLOptions.Method := sslvTLSv1;
SSLOptions.Mode := sslmBoth;
SSLOptions.VerifyMode := [sslvrfClientOnce];
SSLOptions.VerifyDepth := 0;
PassThrough := True;
OnStatusInfo := IdSSLIOHandlerSocketOpenSSLSmtpStatusInfo1;
OnVerifyPeer := IdSSLIOHandlerSocketOpenSSLSmtpVerifyPeer1;
OnStatus := IdSSLIOHandlerSocketOpenSSLSmtpStatus1;
OnBeforeConnect := beforeconnectSSLSMTP1;
OnAfterConnect := afterconnectSSLSMTP1;
OnErrorConnect := errorConnectSSLSMTP1;
end;

IdSASLCRAMMD51 := TIdSASLCRAMMD5.Create(Self);
with IdSASLCRAMMD51 do
begin
UserPassProvider := IdUserPassProvider1;
end;

IdSASLLogin1 := TIdSASLLogin.Create(Self);
with IdSASLLogin1 do
begin
UserPassProvider := IdUserPassProvider1;
end;

IdSASLAnonymous1 := TIdSASLAnonymous.Create(Self);

TheSMTP := TIdSMTP.Create(Self);
with TheSMTP do
begin
OnStatus := TheSMTPStatus1;
IOHandler := IdSSLIOHandlerSocketOpenSSLSmtp;
OnDisconnected := TheSMTPDisconnected1;
OnWork := TheSMTPWork1;
OnWorkBegin := TheSMTPWorkBegin1;
OnWorkEnd := TheSMTPWorkEnd1;
OnFailedRecipient := TheSMTPFailedRecipient1;

AuthType := atSASL;
Host := 'smtp.onebox.com';
Port := 465;
Password := frmMain.YourPassword;
Username := frmMain.YourAccount;
UseTLS := utUseImplicitTLS;

with SASLMechanisms.Add do begin
SASL := IdSASLCRAMMD51;
end;
with SASLMechanisms.Add do begin
SASL := IdSASLLogin1;
end;
with SASLMechanisms.Add do begin
SASL := IdSASLAnonymous1;
end;
UseTLS := utUseImplicitTLS;
OnTLSNotAvailable := TheSMTP1TLSNotAvailable;

end;

===================

The SSL Status messages return these statuses when it makes a good
connection from the OnStatusInfo in the IdSSLIOHandlerSocketOpenSSL

8/17/2006 3:56:15 PM | SSL status: "before/connect initialization"
8/17/2006 3:56:15 PM | SSL status: "SSLv3 write client hello A"
8/17/2006 3:56:15 PM | SSL status: "SSLv3 read server hello A"
8/17/2006 3:56:15 PM | SSL status: "SSLv3 read server certificate A"
8/17/2006 3:56:15 PM | SSL status: "SSLv3 read server done A"
8/17/2006 3:56:15 PM | SSL status: "SSLv3 write client key exchange A"
8/17/2006 3:56:16 PM | SSL status: "SSLv3 write change cipher spec A"
8/17/2006 3:56:16 PM | SSL status: "SSLv3 write finished A"
8/17/2006 3:56:16 PM | SSL status: "SSLv3 flush data"
8/17/2006 3:56:16 PM | SSL status: "SSLv3 read finished A"
8/17/2006 3:56:16 PM | SSL status: "SSL negotiation finished successfully"
8/17/2006 3:56:16 PM | Cipher: name = RC4-MD5; description = RC4-MD5
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
; bits = 128; version = TLSv1/SSLv3;

However, when it fails it returns these messages before it raises an
exception in TIdSSLSocket.Connect
8/17/2006 3:56:15 PM | SSL status: "before/connect initialization"
8/17/2006 3:56:15 PM | SSL status: "SSLv3 write client hello B"

Then it fails.

Remy Lebeau (TeamB) wrote:

Darryl Strickland · Guest

Eugene,
I downloaded and installed the latest version of SecureBlackbox 5 beta but I
cannot find any mention of TELSimpleSMTPClient or demos. Where should this
be?

Thanks
Darryl

Eugene Mayevski wrote:

Eugene Mayevski · Guest

Hello!
You wrote on Thu, 24 Aug 2006 19:07:27 -0400:

DS> I downloaded and installed the latest version of SecureBlackbox 5 beta
DS> but I cannot find any mention of TELSimpleSMTPClient or demos. Where
DS> should this be?

MailBBox*.bpl. Please use HelpDesk (
http://www.eldos.com/support/ticket_list.php ) for SecureBlackbox questions.

With best regards,
Eugene Mayevski