391377 - Error Code: -8101

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Hadmut Danisch]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.6) Gecko/20070723 Iceweasel/2.0.0.6 (Debian-2.0.0.6-1)
Build Identifier: version 2.0.0.4 (20070622) (Debian IceDove)

I have an imap server which supports TLS. Other clients work without any problem. 

But when I use thunderbird (debian icedove) to connect to that imap server, I get the error message

"Could not establish an encrypted connection because certificate presented by ... is invalid or corrupted. Error Code: -8101"

So no chance to guess what this means and no idea were these error codes are defined. 

This part of the thunderbird software is as lousy as if Microsoft had written it...

And its a security problem since it can keep people from using TLS, as it does here. 

Reproducible: Always

Steps to Reproduce:
1. No idea. If I knew what this is about, I could reproduce (or fix) it
2.
3.

Comment 1

[Matthias Versen [:Matti]]

this could or should be a server problem with an invalid vertificate.
moving to PSM where it belongs

Comment 2

[Matthias Versen [:Matti]]

see bug 379710 for the same error code.
"-8101 is SEC_ERROR_INADEQUATE_CERT_TYPE"

Comment 3

[Hadmut Danisch]

BTW, a test with 

openssl s_client -starttls imap -connect server:143

also did not reveal any errors, everything's ok.  Mutt also does not complain.

So it is everything but obvious why thunderbird is denying. 

The certificate is issued by a private CA chain, but all elements of the chain are loaded into Thunderbirds cert repository and marked as trusted. 

Comment 4

[Hadmut Danisch]

OK, this helped, problem fixed, the certificate flags were insufficient. 

However, the error reporting of thunderbird is absolutely insufficient. 

As a quick hack, please include the link to 

http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html

in the error message to allow resolving the error code into something useful. 

regards

Comment 5

[Matthias Versen [:Matti]]

This bug report is invalid based on the reporters comments.
The better error messages is a different bug : bug 107491