我正在使用 python3 和imaplib
连接到 Exchange 服务器。 Exchange 服务器使用为主机名“my.server.fqdn”创建的自签名证书。最近在我的工作站(Ubuntu 14.04)上升级操作系统后,我的 python 脚本不再工作。
我正在使用的基本代码片段在这里:
#!/usr/bin/python3
import imaplib
import socket
import ssl
import getpass
passwd = getpass.getpass()
mail = imaplib.IMAP4_SSL('my.server.fqdn', 1143)
mail.login('mike', passwd)
mail.list()
mail.select("INBOX")
该代码在升级之前运行良好。现在这段代码产生了这个错误:
Traceback (most recent call last):
File "./example.py", line 9, in <module>
mail = imaplib.IMAP4_SSL('my.server.fqdn', 1143)
File "/usr/lib/python3.4/imaplib.py", line 1222, in __init__
IMAP4.__init__(self, host, port)
File "/usr/lib/python3.4/imaplib.py", line 181, in __init__
self.open(host, port)
File "/usr/lib/python3.4/imaplib.py", line 1236, in open
IMAP4.open(self, host, port)
File "/usr/lib/python3.4/imaplib.py", line 257, in open
self.sock = self._create_socket()
File "/usr/lib/python3.4/imaplib.py", line 1228, in _create_socket
server_hostname=server_hostname)
File "/usr/lib/python3.4/ssl.py", line 364, in wrap_socket
_context=self)
File "/usr/lib/python3.4/ssl.py", line 578, in __init__
self.do_handshake()
File "/usr/lib/python3.4/ssl.py", line 805, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:598)
我不清楚 python 的自签名证书、SSL 版本是否有问题,或者 python 3 是否有新的东西不适用于我的旧代码。
我确实有来自 Exchange 服务器的 PEM 文件,它允许我使用以下命令连接到服务器curl
。身份验证失败,但检查curl
SSL 握手期间似乎工作正常。我必须提供curl
the --sslv3
选项以及 PEM 文件的路径以使其正常工作。如果这就是我需要使用 python 来使其再次工作的方法,那么我该如何为 python 提供相同的信息呢?
卷曲会话在这里:
$ curl -vvv --sslv3 https://my.server.fqdn:1143 --cacert ~/my_server_fqdn.pem
* Rebuilt URL to: https://my.server.fqdn:1143/
* Hostname was NOT found in DNS cache
* Trying 10.10.10.10...
* Connected to my.server.fqdn (10.10.10.10) port 1143 (#0)
* successfully set certificate verify locations:
* CAfile: /home/username/my_server_fqdn.pem
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES256-SHA
* Server certificate:
* subject: O=fqdn; O=SERVER; OU=M; CN=my.server.fqdn
* start date: 2013-07-29 20:59:04 GMT
* expire date: 2023-07-27 20:59:04 GMT
* common name: my.server.fqdn (matched)
* issuer: O=fqdn; O=SERVER; OU=M; CN=my.server.fqdn
* SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: my.server.fqdn:1143
> Accept: */*
>
* OK [CAPABILITY IMAP4REV1 AUTH=LOGIN MOVE] IMAP4rev1 server ready
GET BAD command authentication required
User-Agent: BAD command authentication required
Host: BAD command authentication required
Accept: BAD command authentication required
* SSLv3, TLS alert, Client hello (1):
* Connection #0 to host my.server.fqdn left intact