File: starttls.el.html

This module defines some utility functions for STARTTLS profiles.

[RFC 2595] "Using TLS with IMAP, POP3 and ACAP"
by Chris Newman <chris.newman@innosoft.com> (1999/06)

This file now contains a combination of the two previous implementations both called "starttls.el". The first one is Daiki Ueno's starttls.el which uses his own "starttls" command line tool, and the second one is Simon Josefsson's starttls.el which uses
"gnutls-cli" from GnuTLS.

If "starttls" is available, it is preferred by the code over
"gnutls-cli", for backwards compatibility. Use
starttls-use-gnutls to toggle between implementations if you have both tools installed. It is recommended to use GnuTLS, though, as it performs more verification of the certificates.

The GnuTLS support requires GnuTLS 0.9.90 (released 2003-10-08) or later, from <https://www.gnu.org/software/gnutls/>, or "starttls" from <ftp://ftp.opaopa.org/pub/elisp/>.

Usage is similar to open-network-stream. For example:

(when (setq tmp (starttls-open-stream
"test" (current-buffer) "yxa.extundo.com" 25))
  (accept-process-output tmp 15)
  (process-send-string tmp "STARTTLS\\n")
  (accept-process-output tmp 15)
  (message "STARTTLS output:\\n%s" (starttls-negotiate tmp))
  (process-send-string tmp "EHLO foo\\n"))

An example run yields the following output:

220 yxa.extundo.com ESMTP Sendmail 8.12.11/8.12.11/Debian-3; Wed, 26 May 2004 19:12:29 +0200; (No UCE/UBE) logging access from: c494102a.s-bi.bostream.se(OK)-c494102a.s-bi.bostream.se [217.215.27.65]
220 2.0.0 Ready to start TLS
250-yxa.extundo.com Hello c494102a.s-bi.bostream.se [217.215.27.65], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH DIGEST-MD5 CRAM-MD5 PLAIN LOGIN
250-DELIVERBY
250 HELP
nil

With the message buffer containing:

STARTTLS output:
*** Starting TLS handshake
- Server's trusted authorities:
   [0]: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com
- Certificate type: X.509
 - Got a certificate list of 2 certificates.

 - Certificate[0] info:
 # The hostname in the certificate matches 'yxa.extundo.com'.
 # valid since: Wed May 26 12:16:00 CEST 2004
 # expires at: Wed Jul 26 12:16:00 CEST 2023
 # serial number: 04
 # fingerprint: 7c 04 4b c1 fa 26 9b 5d 90 22 52 3c 65 3d 85 3a
 # version: #1
 # public key algorithm: RSA
 # Modulus: 1024 bits
 # Subject's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=Mail server,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com
 # Issuer's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com

 - Certificate[1] info:
 # valid since: Sun May 23 11:35:00 CEST 2004
 # expires at: Sun Jul 23 11:35:00 CEST 2023
 # serial number: 00
 # fingerprint: fc 76 d8 63 1a c9 0b 3b fa 40 fe ed 47 7a 58 ae
 # version: #3
 # public key algorithm: RSA
 # Modulus: 1024 bits
 # Subject's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com
 # Issuer's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com

- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted
- Version: TLS 1.0
- Key Exchange: RSA
- Cipher: ARCFOUR 128
- MAC: SHA
- Compression: NULL

Defined variables (9)

starttls-connectRegular expression indicating successful connection.
starttls-extra-argsExtra arguments to ‘starttls-program’.
starttls-extra-argumentsExtra arguments to ‘starttls-gnutls-program’.
starttls-failureRegular expression indicating failed TLS handshake.
starttls-gnutls-programName of GnuTLS command line tool.
starttls-process-connection-typeValue for ‘process-connection-type’ to use when starting STARTTLS process.
starttls-programThe program to run in a subprocess to open an TLSv1 connection.
starttls-successRegular expression indicating completed TLS handshakes.
starttls-use-gnutlsWhether to use GnuTLS instead of the ‘starttls’ command.

Defined functions (5)

starttls-available-p()
starttls-negotiate(PROCESS)
starttls-negotiate-gnutls(PROCESS)
starttls-open-stream(NAME BUFFER HOST PORT)
starttls-open-stream-gnutls(NAME BUFFER HOST PORT)

Defined faces (0)