[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: smtpmail/starttls starts connection but never sends

From: William Gardella
Subject: Re: smtpmail/starttls starts connection but never sends
Date: Tue, 13 Nov 2012 22:01:28 -0500
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.2 (gnu/linux)

Hello Joost,

Joost Kremers <> writes:

> Hi all,
> I'm running Emacs 24.2 on OS X Lion (more precisely, I'm using the
> emacs-mac-port from <>) and
> using it for email with mu4e. The other day, I ran into a problem with
> sending mail, in that I can't anymore...
> The emacs-mac-port is compiled without tls, so it uses the external
> gnutls program for establishing tls connections, which worked fine,
> until Homebrew upgraded gnutls. The problem is that gnutls-cli stopped
> accepting certificates that cannot be verified. As a result, the
> connection would be dropped and Emacs would tell me that no smtpmail
> process was running. (Note: mu4e uses message-mode for composing and
> smtpmail for sending email, so this issue shouldn't be mu4e-specific).
> After some googling, I found that one way to get around this *should* be
> to establish a connection manually once with the --tofu option, accept
> the certificate when asked to, and then add the --tofu option to
> starttls-extra-arguments, as explained in a post to gnu.emacs.gnus:
> <>.

I wonder if you've tried playing around with the `tls-checktrust'
variable.  If you (setq tls-checktrust 'ask), you should be able to
manually accept untrusted SSL/TLS keys by responding to a dialog in
Emacs.  Along with setting `tls-checktrust' to ask, you can set
`tls-program' to have a command line that will allow you to call
gnutls-cli with your own private list of certificates.  For me here in
Debian GNU/Linux, the following is a working TLS configuration that
checks certs but also lets me use invalid/self-signed ones when I wish:

(setq tls-checktrust 'ask
      '("gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h"
        "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h 
--protocols ssl3"
        "openssl s_client -connect %h:%p -CAfile 
/etc/ssl/certs/ca-certificates.crt -no_ssl2 -ign_eof"))

Maybe this will help you if gnutls --insecure is no longer working.

> In my case, this doesn't entirely work, however. Although the connection
> appears to be established, nothing is actually sent. I get the following
> message in the minibuffer:
> Opening STARTTLS connection to `'...done
> and that's where it stays. Emacs is locked, the message buffer remains
> open and active and nothing happens. I have to hit C-g to get control
> back.
> Anyone know what might be going on, or how I could debug this further?

If the above doesn't work, you can use strace or dtrace to see where in
the TLS-calling process Emacs hangs.  You can also try writing out an
`open-network-stream' function call of your Emacs trying to talk to your
mail server and stepping through it with (edebug-defun).


I use grml (

reply via email to

[Prev in Thread] Current Thread [Next in Thread]