Synapse cannot connect using SSL (IMAP and SMTP) with newer Linux versions. lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- bernie61 · 2017-05-15 01:38 I developed a program to send and receive email on Lubuntu 15.10 (Virtual Machine) with Lazarus 1.4.4 and Synapse. There it runs perfectly. When I run it on newer Linux versions, luke Lubuntu 16.04, Xubuntu 16.04 or Debian Jessie, it runs but cannot send nor receive email. The login fails. I installed Lazarus on Debian Jessie and Lubuntu 16.04, and compiled there my program, thinking that in that way it may be linked with the right libraries. It compiles fine in both systems, but still it fails to connect by SMTP or IMAP when it runs. May be Synapse, which is quite old, links with outdated SSL libraries? It is a guess. If somebody has some tip to make this work, please share it with me. Regards, Bernie ---------------------------------------------------------------------- Phil · 2017-05-15 02:28 Quote from: bernie61 on May 15, 2017, 03:38:44 amMay be Synapse, which is quite old, links with outdated SSL libraries? It is a guess. If somebody has some tip to make this work, please share it with me. Be sure to use Synapse from trunk. ---------------------------------------------------------------------- Thaddy · 2017-05-15 05:12 And more important use one of the latest versions of openssl. The reason it doesn't work is because openssl dropped some protocols. I mean dropped, no longer present because of security reasons. With Synapse trunk, start always with TLS1.2 and not with anything else. (no sslv3, sslv2, tls1.0) Synapse needs some  work on its ssl, but if you start with TLS 1.2 it works. Some websites accept a fallback to sslv2 but not anything else. Note modern webservers, email servers browsers and email clients also do not accept sslv3/tls1.0 so don't use these protocols. Note that outdated ssl is rather unlikely: most distro's have still security updates for versions even older then LTS, so the openssl libs are almost always current if you apt update. ---------------------------------------------------------------------- bernie61 · 2017-05-15 12:29 Hi, thank you your recommendations. I downloaded the last synapse from trunk and added two lines (the indented ones), before the login line:     imap := TImapSend.Create;     imap.Username := UN;     imap.Password := PA;     imap.FullSSL:=true;     imap.AutoTLS:=true;        imap.TargetPort:=IPORT;     imap.TargetHost := HO;        imap.Sock.SSL.SSLType:=LT_TLSv1_2;        imap.Sock.SSLDoConnect();  The problem is still there. Any insights? What I'm doing wrong. Thanks in advance, Bernie61 ---------------------------------------------------------------------- Thaddy · 2017-05-15 12:37 What happens with autotls = false ? ---------------------------------------------------------------------- bernie61 · 2017-05-15 12:49 Quote from: Thaddy on May 15, 2017, 02:37:05 pmWhat happens with autotls = false ? It also fails to connect. ---------------------------------------------------------------------- doitf · 2019-03-31 01:32 Hope would help someone: Ubuntu 18.04, HTTPS в Synapse (some trunk version) doeson't work. libssl-dev is installed. On 16.04 https worked fine. Problem solved by changing libs to older version in ssl_openssl_lib.pas: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i      {$ELSE OS2}     DLLSSLName: string = 'libssl.so.1.0.0';//    DLLSSLName: string = 'libssl.so';    DLLUtilName: string = 'libcrypto.so.1.0.0';//    DLLUtilName: string = 'libcrypto.so';  File version: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i | Project : Ararat Synapse                                       | 003.007.002 | ---------------------------------------------------------------------- Thaddy · 2019-03-31 06:35 That's the wrong way to go. The likely cause is that you have selected the wrong prototcol: it should be tls 1.2. with fallback to tls 1.1. All older/other protocols are deprecated in newer OpenSSL binaries and some are not even compiled in by default. If you *must* use OpenSSL with a lower release number, at least pick one that is maintained and is fully patched. OpenSsl maintains several branches. (e.g. OpenSSL 1.0.2r  at the minimum, or OpenSSL 1.0.2 + a high patch character close to r) You must also make sure your server binaries are up-to-datre, of course: if they do not support tls 1.2 they are too old. I am myself using OpenSsl 1.1.0j on Debian, which is recent and that works, provided the software on the other side is also up-to-date. Tip: build a small example in fcl-web and see if OpenSSL works there. But plz check any other software to which you want to connect too. As I wrote: if they still use one of the SSL* protocols, they won't work. Also note that redirects should be allowed. E.g. compile the httpclient example from fcl-web, comment out the USEGNUTLS define so it uses OpenSsl and run it like so:Code: Bash  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i ./httpget https://gmail.com STDOUTIf that works you know you have to look elsewhere because synapse works similar and with the same openssl install. Note this URL contains several redirects, to test if that works properly too. If your output looks like this your software is likely OK:Code: Bash  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i Reading headers : 608 Bytes.Response headers received:Location: https://www.google.com/gmail/Content-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Mon, 18 Mar 2019 01:26:19 GMTExpires: Wed, 17 Apr 2019 01:26:19 GMTServer: sffeContent- Length: 226X-XSS-Protection: 1; mode=blockCache-Control: public, max- age=2592000Age: 1142996Alt-Svc: clearConnection: closeFollowing redirect from https://gmail.com  ==> https://www.google.com/gmail/Reading headers : 549 Bytes.Response headers received:Location: https://mail.google.com/mail/Cache-Control: privateContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Sun, 31 Mar 2019 06:56:15 GMTServer: sffeContent-Length: 226X-XSS-Protection: 0Alt-Svc: quic=":443"; ma=2592000; v="46,44,43,39"Connection: closeFollowing redirect from https://www.google.com/gmail/  ==> https://mail.google.com/mail/Reading headers : 981 Bytes.Response headers received:Content-Type: text/html; charset=UTF-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 31 Mar 2019 06:56:15 GMTLocation: https://accounts.google.com/ServiceLogin?service=mail&pas sive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&l tmpl=default<mplcache=2&emr=1&osid=1#X-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: clearAccept-Ranges: noneVary: Accept- EncodingConnection: closeFollowing redirect from https://mail.google.com/mail/  ==> https://accounts.google.com/Service Login?service=mail&passive=true&rm=false&continue=https://mail.google. com/mail/&ss=1&scc=1<mpl=default<mplcache=2&emr=1&osid=1#Reading headers : 965 Bytes.Response headers received:Content-Type: text/html; charset=UTF-8X-Frame-Options: DENYLink: ; rel="canonical"x-auto-login: realm=co m.google&args=service%3Dmail%26continue%3Dhttps%253A%252F%252Fmail.goo gle.com%252Fmail%252FCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 31 Mar 2019 06:56:15 GMTTransfer-Encoding: chunkedStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'report-sample' 'nonce-323pwCB0K8OMhz3yu1k9rA' 'unsafe-inline' 'unsafe-eval';object- src 'none';base-uri 'self';report-uri /cspreportX-Content-Type- Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSESet-Cookie: GAPS=1:kMVjk08ZK6W0XflJ6Xlhfifhi5gc5g:aO2pInhpvtrN3BA6;Path=/;Expires= Tue, 30-Mar-2021 06:56:15 GMT;Secure;HttpOnly;Priority=HIGHAlt-Svc: quic=":443"; ma=2592000; v="46,44,43,39"Connection: close---- more