path: root/imap-dl
diff options
authorRobbie Harwood <>2020-03-10 12:54:50 -0400
committerSean Whitton <>2020-03-19 13:22:52 -0700
commit6e26cfb34ae96f2dbef3660afd1857b31bd6ea5c (patch)
tree78d37ac85718d490b83508b67bcba59a3ece4e76 /imap-dl
parente4e5653d1c79ab0be13479fa8dff6b299624ea8b (diff)
imap-dl: Allow specifying ssl_ciphers
In my case, this allows supporting servers which have unacceptably (for systemwide OpenSSL) small DH sizes by requesting non-DH ciphers. Specifically, hardcoding AES256-GCM-SHA384 prevents this traceback: Traceback (most recent call last): File "/usr/bin/imap-dl", line 273, in <module> scan_msgs(confname, args.verbose) File "/usr/bin/imap-dl", line 133, in scan_msgs ssl_context=ctx) as imap: File "/usr/lib/python3.7/", line 1288, in __init__ IMAP4.__init__(self, host, port) File "/usr/lib/python3.7/", line 198, in __init__, port) File "/usr/lib/python3.7/", line 1301, in open, host, port) File "/usr/lib/python3.7/", line 299, in open self.sock = self._create_socket() File "/usr/lib/python3.7/", line 1293, in _create_socket File "/usr/lib/python3.7/", line 423, in wrap_socket session=session File "/usr/lib/python3.7/", line 870, in _create self.do_handshake() File "/usr/lib/python3.7/", line 1139, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: DH_KEY_TOO_SMALL] dh key too small (_ssl.c:1076) Signed-off-by: Robbie Harwood <> Acked-by: Daniel Kahn Gillmor <>
Diffstat (limited to 'imap-dl')
1 files changed, 4 insertions, 0 deletions
diff --git a/imap-dl b/imap-dl
index de6be60..a1c2329 100755
--- a/imap-dl
+++ b/imap-dl
@@ -116,6 +116,10 @@ def scan_msgs(configfile:str, verbose:bool) -> None:
'(found "{on_size_mismatch_str}")')
ctx = ssl.create_default_context(cafile=ca_certs)
+ ssl_ciphers = conf.get('retriever', 'ssl_ciphers', fallback=None)
+ if ssl_ciphers:
+ ctx.set_ciphers(ssl_ciphers)
server:str = conf.get('retriever', 'server')
with imaplib.IMAP4_SSL(host=server, #type: ignore
port=int(conf.get('retriever', 'port', fallback=993)),