1

I have several email accounts with a specific provider. Since yesterday both POP3 and SMTP fail silently on all accounts and all email readers (Thunderbird on Linux, K9 on Android).

Thunderbird's debug console gives me a pretty cryptic and useless "mailnews.pop3.2: NetworkInterruptError: a Network error occurred"

All my accounts are configured to use SSL/TLS (and have been for 2 decades), but if I set it to 'None' I can login and see the messages, so it's not a passwd problem. So my guess is that it's some issue on the server side. I tried security.tls.version.min=1 and security.tls.version.enable-deprecated=true to no avail.

What can I do to diagnose this better ? Thunderbird doesn't give much info.

EDIT:

I don't know if this is the right command but if I do the following it seems to answer nothing. Is the server certificate missing ?

$ openssl s_client -showcerts -connect mail.myserver.com:995
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 319 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

EDIT 2

It was a permission problem on the server certificate. There's nothing I could have done on my side. It's solved now.

5
  • 1
    Step one would be to configure it as if it were new. Maybe you can use portable thunderbird or something like that. Also, check IMAP instead of pop3. Just to rule it out. Its likely something on your email server. Certificate okay? Can you configure it without SSL?. Once you narrow down the problem, maybe contact support for your email server.
    – LPChip
    Jun 7, 2023 at 19:35
  • Did you configure incoming email for port 995 and outgoing for 587?
    – John
    Jun 7, 2023 at 19:49
  • Yes, it works if I disable SSL. Yes, I use ports 995/587. Apparently they updated SSL on the server, but that doesn't explain anything (yet)...
    – dargaud
    Jun 8, 2023 at 4:05
  • 1
    This could also be an operating system-level issue. E.g., newer certificates on the server are not trusted by the operating system. Or, the mail server only supports versions of TLS that the operating system cannot handle. E.g., the NSS library on the client is out of date. I believe Thunderbird uses NSS for TLS, but I don't know for certain under what conditions Thunderbird links against the host's NSS library versus statically linking it. Jul 5, 2023 at 7:34
  • Thanks. I deleted the corresponding certificate in Thunderbird, and reinstated the SSL/TLS but nothing happens. Thunderbird doesn't ask or display anything when I press "Get Messages" (not even "checking email"). And nothing arrives. Why isn't there a communication log somewhere ?
    – dargaud
    Jul 6, 2023 at 19:27

2 Answers 2

1

Thanks for the openssl output. It looks like the server mail.myserver.com is not returning any data: SSL handshake has read 0 bytes. If the server was working before, and after configuration changes they made, is no longer working, then that most likely sounds like they've changed the SSL or TLS protocol versions and cipher suites that they offer and the existing SSL and TLS libraries on your systems cannot use those protocols.

Without knowing the actual hostname we cannot diagnose the issue directly, but you can put in the hostname and port (e.g., mail.myserver.com:995) to this website:

https://testtls.com/

Which will give a detailed report of the available protocols and ciphers that the host is offering. You can do a quick check of TLS versions 1.0, 1.1, 1.2, and 1.3 with the following options passed to openssl:

  • -tls1 for TLS 1.0
  • -tls1_1 for TLS 1.1
  • -tls1_2 for TLS 1.2
  • -tls1_3 for TLS 1.3

E.g., openssl s_client -showcerts -connect mail.myserver.com:995 -tls1_3 to see if the server supports TLS version 1.3.

Out of curiosity, what is the version of openssl that you are working with? openssl version should tell you.

1
  • 1
    Current Ubuntu, so OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023). And testtls says Client problem, No server cerificate could be retrieved. Thus we can't continue with 'server defaults'. so I guess that means there isn't any SSL on THAT port.
    – dargaud
    Jul 7, 2023 at 12:03
0

It was a permission problem on the server certificate. There's nothing I could have done on my side. It's solved now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .