Bug 2230036

Summary:	TLS broken for POP3 and SMTP connections [8.8.z]
Product:	Red Hat Enterprise Linux 8	Reporter:	Jan Horak <jhorak>
Component:	thunderbird	Assignee:	Jan Horak <jhorak>
Status:	CLOSED ERRATA	QA Contact:	Vladimir Benes <vbenes>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.8	CC:	abobrov, amike, axelheider, desktop-qa-list, erack, jwboyer, vbenes
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-10 13:27:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Horak 2023-08-08 14:16:12 UTC

This bug was initially created as a copy of Bug #2229981

I am copying this bug because: 



Description of problem:
TLS is broken on the latest thunderbird release

Version-Release number of selected component (if applicable):
thunderbird-102.14.0-1.el7_9.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Configure thunderbird to use TLS for pop3 or smtp connections
2. Update thunderbird to 102.14.0-1.el7_9.x86_64
3. Launch thunderbird and attempt tls connection

Actual results:
TLS connection fails with the following entry in maillog:

Aug  7 19:06:15 mail_server dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.1, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<ddk1GlkCBqjAqAAB>

Expected results:
tls connections work as expected

Additional info:
Downgrading to thunderbird-102.13.0-2.el7_9.x86_64 fixes the issue
Disabling SSL/TLS security and sending authentication in plain text (highly undesirable) also works
TLS cert is self signed and imported into thunderbird, with expiry date 2028

Comment 6 Vladimir Benes 2023-08-09 21:59:16 UTC

thunderbird-102.14.0-3.el8_8.x86_64 can correctly read the IMAP account, while thunderbird-102.14.0-1.el8_8.x86_64 can not.

Comment 10 errata-xmlrpc 2023-08-10 13:27:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (thunderbird bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:4617

Comment 11 Tomas Popela 2023-08-28 14:04:47 UTC

*** Bug 2235319 has been marked as a duplicate of this bug. ***