server certificate for pop3d (qpopper)

Hi,

I'm trying to establish a ssl pop3 connection between my pc and a
local network pop3 server (qpopper last release tarball) on linux
mandrake.
Everything seems to be ok, without encryption, I can pickup my mails.
When enabling ssl/tls support, I get following error in my mail client
(the bat!):
- enabling tls handshake
- certificate S/N 0 Algorithm RSA (1024 bits) created 27 April 2004
until 27 April 2007 for one host "me"
- owner: me,mystate,mycity,mycompany,myname,myemail
- the certificate has been created by own
- certificate not valid because it's not in the trusted-ca adress-book
- server tells error +OK TLS

Then I imported my self-signed certificate in this adress-book, into
trusted-root-ca. Then I had an other error:
- enabling tls handshake
- certificate S/N 0 Algorithm RSA (1024 bits) created 27 April 2004
until 27 April 2007 for one host "me"
- owner: me,mystate,mycity,mycompany,myname,myemail
- the certificate has been created by own
- certificate differs from "192.168.0.230"
- server tells error +OK TLS


Here is the way I created the certificate:
1. openssl req -new -nodes -out req.pem -keyout cert.pem
2. openssl genrsa -out server.key 1024
3. openssl x509 -days 1095 -extfile ca.ext -signkey server.key -in
req.pem -req -out signed_cert.pem

and ca.ext contains:
extensions = x509v3

[ x509v3 ]
basicConstraints = CA:true,pathlen:0
crlDistributionPoints = URI:http://192.168.0.230/ca/mustermann.crl
nsCertType = sslCA,emailCA,objCA
nsCaPolicyUrl = "http://192.168.0.230/ca/policy.htm"
nsCaRevocationUrl = "http://192.168.0.230/ca/heimpold.crl"
nsComment = "company"

I'd apreciate help, thanks


SvT

Safran von Twesla schrieb am Tue, 27 Apr 2004 22:56:21 +0200:

> - certificate differs from "192.168.0.230"
>

We are not using qpopper or Bat, so I can't tell you for sure how it works
with them. But I think you can't use an IP for the hostname. Use the same
hostname your machine identifies itself in the HELO. Works just fine for
us with ipop3d, even without importing the CA cert.

Kai
--

Conactive Internet Services, Berlin, Germany