- if (outlevel == O_VERBOSE)
- report(stdout, _("Server CommonName: %s\n"), cbuf);
-
- if (_ssl_server_cname != NULL)
- {
- char *p1 = cbuf;
- char *p2 = _ssl_server_cname;
- int n;
-
- if (*p1 == '*')
- {
- ++p1;
- n = strlen(p2) - strlen(p1);
- if (n >= 0)
- p2 += n;
- }
- if ( 0 != strcasecmp( p1, p2 ) )
- report(stdout,
- "Server CommonName mismatch: %s != %s\n",
- cbuf, _ssl_server_cname );
- }
- } else {
- if (outlevel == O_VERBOSE)
- report(stdout, _("Unknown Server CommonName\n"));
+ if (!X509_digest(x509_cert, digest_tp, digest, &dsz)) {
+ report(stderr, GT_("Out of memory!\n"));
+ return (0);
+ }
+ tp = text;
+ te = text + sizeof(text);
+ for (dp = 0; dp < dsz; dp++) {
+ esz = snprintf(tp, te - tp, dp > 0 ? ":%02X" : "%02X", digest[dp]);
+ if (esz >= (size_t)(te - tp)) {
+ report(stderr, GT_("Digest text buffer too small!\n"));
+ return (0);
+ }
+ tp += esz;
+ }
+ if (outlevel > O_NORMAL)
+ report(stdout, GT_("%s key fingerprint: %s\n"), _server_label, text);
+ if (_check_digest != NULL) {
+ if (strcasecmp(text, _check_digest) == 0) {
+ if (outlevel > O_NORMAL)
+ report(stdout, GT_("%s fingerprints match.\n"), _server_label);
+ } else {
+ report(stderr, GT_("%s fingerprints do not match!\n"), _server_label);
+ return (0);
+ }
+ } /* if (_check_digest != NULL) */
+ } /* if (_check_fp) */
+ } /* if (depth == 0 && !_depth0ck) */
+
+ if (err != X509_V_OK && err != _prev_err && !(_check_fp != 0 && _check_digest && !strict)) {
+ _prev_err = err;
+
+ report(stderr, GT_("Server certificate verification error: %s\n"), X509_verify_cert_error_string(err));
+ /* We gave the error code, but maybe we can add some more details for debugging */
+
+ switch (err) {
+ case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+ X509_NAME_oneline(issuer, buf, sizeof(buf));
+ buf[sizeof(buf) - 1] = '\0';
+ report(stderr, GT_("unknown issuer (first %d characters): %s\n"), (int)(sizeof(buf)-1), buf);
+ report(stderr, GT_("This error usually happens when the server provides an incomplete certificate "
+ "chain, which is nothing fetchmail could do anything about. For details, "
+ "please see the README.SSL-SERVER document that comes with fetchmail.\n"));
+ break;
+ case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+ case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+ case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+ X509_NAME_oneline(subj, buf, sizeof(buf));
+ buf[sizeof(buf) - 1] = '\0';
+ report(stderr, GT_("This means that the root signing certificate (issued for %s) is not in the "
+ "trusted CA certificate locations, or that c_rehash needs to be run "
+ "on the certificate directory. For details, please "
+ "see the documentation of --sslcertpath and --sslcertfile in the manual page.\n"), buf);
+ break;
+ default:
+ break;