freeipa

#8579 EPN: SMTP client doesn't validate server certificate
Closed: fixed by rcritten. Opened by slev.

Closed: fixed
Reopen Issue

If smtp_security is specified as starttls or ssl via epn.conf then EPN SMTP client doesn't perform server certificate validation and hostname checking.

In order to verify connections in smtplib you have to pass a context to SMTP.starttls() or SMTP_SSL():

context = ssl.create_default_context()
smtp = smtplib.SMTP(...)
smtp.starttls(context=context)

Thank you.
This is proposed in https://github.com/freeipa/freeipa/pull/5257

master:

  • be006ad6c4e36fd53212a5e573524d1c96dfab39 ipatests: Respect platform's openssl dir
  • 94adee3c73f039fc2d985afd1681cd64ece55116 EPN: Don't downgrade security
  • 977063a56ef8f11c75a4cdd836f8692155337c7b test_epn: Standardize EPN configs for deduplication
  • 32aa1540f0f25864816eced0b2f569a6cdfd3973 EPN: Enable certificate validation and hostname checking
  • 17f430efc4cf438b6c052465b8252688bc5822f9 EPN: Allow authentication by SMTP client's certificate
  • 82e69008ad43b993a2d3664b3ea35d9f84f2679a ipatests: Collect EPN log for debugging

ipa-4-8:

  • 1f0c5cc2ff6ed65579930d6afe38b501ca3f53ed ipatests: Respect platform's openssl dir
  • 9b756a709a60e76ae2d151d49e4894b9032ba96d EPN: Don't downgrade security
  • 3c83c98212fe379371215a57167f9a792e30b0b9 test_epn: Standardize EPN configs for deduplication
  • 119ebed28b715d29c42623e4948ba0d7cc652360 EPN: Enable certificate validation and hostname checking
  • 058d51f43db4b6ff0861402b69b07c4e6522cd10 EPN: Allow authentication by SMTP client's certificate
  • 461b4635bfee19845b4e27280f4d118ab1900561 ipatests: Collect EPN log for debugging

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.