Mail can't verify the identity of "pop.gmail.com"

Question

Mail can't verify the identity of "pop.gmail.com"

Hey guys, I've a client getting "Mail can't verify the identity of "pop.gmail.com"" messages in Mail in OSX 10.5.8. Her POP and SMTP settings seem fine from asking her over the phone, and all is well if she selects "Connect" and uses the certificate Mail takes issue with, regardless.

Also apparently the message is only intermittent, not happening every time she connects to the POP server.

When she okays use of a certificate by selecting "Connect" anyway, is OSX then allowing future usage of the certificate for a set time? I seem to recall when I last had a dodgy certificate in OSX that I had to ok use every single time. Has that changed? Or is my memory faulty?

I ask as I'm trying to work out why she's only getting that message intermittently, as it's either 10.5.8 being unable to authenticate the certificate, the certificate itself being out of date (seems unlikely - this is Google after all), or possibly a connection issue affecting connecting to the POIP server during authentication.

TIA,

Jamie Kahn Genet

Posted on Sep 4, 2011 8:43 PM

Reply

Answer 1

BDAqua

Level 10

238,841 points

Sep 5, 2011 12:16 AM in response to BaboonLoveMonkey

Hi Jamie,

Sorry to report, it's a big problem & may not be safe to accept anyway...

http://x704.net/bbs/viewtopic.php?f=17&t=5472

http://www.wired.com/threatlevel/2011/08/diginotar-breach/

Reply

Answer 2

Sep 5, 2011 7:31 AM in response to BDAqua

I don't see how that would affect commication with the gmail POP server, unless a man-in-the-middle attack was occuring, and I think I can say with some certainty it wasn't in this case.

Reply

Answer 3

BDAqua

Level 10

238,841 points

Sep 5, 2011 11:15 AM in response to BaboonLoveMonkey

Well, what is the expiration date & such on the certificate?

Reply

Answer 4

Sep 27, 2012 4:10 PM in response to BDAqua

I got this just now, Thunderbird 15.0.1 on 10.8.2

The certificate that Thunderbird is getting presented appears to be Google's imap.google.com (which clearly doesn't match pop.google.com)

Thunderbird says "This certificate is not valid (host name mismatch)".

I have to think this is just google screwing up presenting a mismatching named cert - the cert itself looks valid, with a trust chain to Equifax Secure Certificate Authority.

Reply