Bug: TB doesn't work with POP3 when server name is different than in SSL cert
Status: RESOLVED
Priority: --
Resolution: WORKSFORME
Created: 2021-01-30 00:10:29+00:00
Resolved: 2024-03-24 20:06:29+00:00

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:85.0) Gecko/20100101 Firefox/85.0

Steps to reproduce:

I have pop3 server powered by Dovecot and SSL cert is from Let's Encrypt.
TB versions before November 2020 were able to connect and download emails, but around November it silently (!) stopped doing so. 

The problem is that my SSL cert is issued for domain example.com but not for mail.example.com which is the address I was using for account configuration. I've confirmed that my POP3 works in other mail programs (they properly display warning that SSL cert is for a different server and I can confirm the exception).

Not sure if it is relevant, but on server side in logs of Dovecot I see:
Disconnected (no auth attempts in 0 secs): user=<>, rip=a.b.c.d, lip=z.x.y.w, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<...>"



Actual results:

There are 4 main problems:

1) The example.com mailbox configuration is being silently ignored when I click Get All New Mails button, periodic new mail check behaves the same - it doesn't complain about wrong certificate (i.e. domain doesn't match).

2) When I explicitly choose mail.example.com mailbox to get new emails, then I receive pop-up that certificate is wrong and where I can confirm this exception, but:

2a) When I click Confirm security exception button nothing happens, dialogbox closes and that's it - still no emails are being downloaded.

2b) When I click 'Download Certificate' on this modal, then 'Confirm security exception' becomes disabled, in main TB windows status bar I see that connection is being made to server and it stays like this. All I can do is to click Cancel

3) When I wanted to change server name in account configuration to be the same as in SSL cert, then suddenly modal appears stating something like "Server name has changed. You must check whether all folders used by filters are still on the server"  (I have TB in non-english l18n) - when I click OK, then TB freezes to death - apparently is trying to connect to the server using old server name? I have to kill TB and after restart TB is able to connect to pop3 using new (correct) server name and download emails.

4) Manually adding SSL exception for server still doesn't work (the same problem as here on the screenshot:  https://bugzilla.mozilla.org/show_bug.cgi?id=1629416#c6 , probably related to https://bugzilla.mozilla.org/show_bug.cgi?id=1590474)


Expected results:

ad 1) The information that something is wrong with account should appear, instead of silently being ignored. If this account is not used regularly, one may find out (like me) after months that emails are not being downloaded properly. Even TB Activity Monitor doesn't state that anything is wrong (btw, I think that this Activity Monitor is really poor - if it was better in what it should do, then probably you guys would have a lot less tickets reported or they could be more precise).

ad 2a & 2b) it should work - I should be able to confirm exception, I should be able to 'download' cert. 

ad 3) changing server name should work - I don't create another issue for it, as I think it is somehow related to 1) or 2)

ad 4) obviously one should be able to manually add exceptions

TB version: 78.7, macOS: 10.15.7