0

I have an application that connects through POP3 over SSL. It mostly works correctly--but the last few days, I have been repeatedly getting this error: -ERR Re-Authentication Failure

What could cause this? And how can I cut down on it? We currently have the application set up to send error messages to the team if it fails 5 times in a row--and the last two days that error message has been triggered.

It still continues to work, just with problems here and there--that we'd like to fix if possible.

Improve this question
3
  • Is everything OK with the SSL cert? e.g. has it been revoked or expired/similar?
    – William Hilsum
    Feb 8, 2011 at 17:03
  • @Wil: The SSL Cert is associated with a related website, but not the direct subdomain involved (SSL cert: webmail.domain.com, POP3 connection: pop3.domain.com). Would that lead to this problem?
    – Brisbe42
    Feb 8, 2011 at 17:10
  • It could be - have you changed/modified anything recently? If the SSL cert is for a different address to the connection, it will fail.... (or at least come up with errors). At the end of the day, the encryption will not be any less secure, which is why it can work/you can ignore, but SSL is also about validation/confirming identity, and by using a certificate from a different address, you fail this part/invalidate the certificate.
    – William Hilsum
    Feb 8, 2011 at 17:42

1 Answer 1

Reset to default
1

Based on your comment above.

I am not sure why it works sometimes and not others, unless you have recently changed something.

SSL/Certification has two different sides to it. One is encryption, the other is identity verification.

If your domain does not match the common name of the certificate, the verification part of the certificate will fail. This does not mean that the certificate is any less secure for the encryption, it just means the certificate is not (fully) valid.

I recommend reissuing the certificate with the new name, or possibly getting a wildcard certificate.

In your code, you can obviously "ignore" warnings and just use it for encryption, however, unless you also have a client certificate, or some other form of security, without the verification part of SSL, it could be possible for someone to fake a certificate in the correct name. (although, unless you have third party trusted roots, this is unlikely).

Improve this answer
1
  • We did end up having to ignore the certificate warnings, as the server on the other end kept having problems. This therefore ended up basically being what we did.
    – Brisbe42
    Dec 15, 2011 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .