Some time between three weeks ago and about a week ago (I was away for a few days inbetween) something changed (on both my Tumbleweed machines) something changed in the way certificates get checked for one of the mail servers I'm using: --8<---------------cut here---------------start------------->8--- ~> openssl s_client -showcerts -starttls smtp -connect smtp.vodafonemail.de:25 -name smtp.vodafonemail.de CONNECTED(00000003) depth=0 CN = www.vodafonemail.de verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = www.vodafonemail.de verify error:num=21:unable to verify the first certificate verify return:1 depth=0 CN = www.vodafonemail.de verify return:1 --- Certificate chain 0 s:CN = www.vodafonemail.de i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA -----BEGIN CERTIFICATE----- MIIIKjCCBxKgAwIBAgIRAMSaOQvw1EiEUuAukU6jRdkwDQYJKoZIhvcNAQELBQAw gY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE AxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD QTAeFw0yMDEwMTkwMDAwMDBaFw0yMTExMTkyMzU5NTlaMB4xHDAaBgNVBAMTE3d3 dy52b2RhZm9uZW1haWwuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDlRI2/4Ctq02gGw6gfmX6A6NZn768AghOawnPI0XTWX45J0+Wi+AVdY+Ptnmfg Gx8liOFsukceGUzUTjSHjolJ8wbqkg7ksBXUXn/JAE9hHdLi3VR5Vz7FuVotEmQK DOsl9sDCJo2xKlOM4X4iyM6yPR00KIqEdq9hvumS1yeSpkPhYSqeEujpEFVhW/6p WUT8ZXNtkCoSAdjJxTyptynT8FAb7osgNIIZL1FXlSyL3tQRBrFcGzbl7GNTeTGf zlyVjvIxp8UiLo4Fr7y0lS+i/32qw+yrURoJXirG6CkJDDTz8vkxoHSie64g/QoW 5PcQwxKNoQLMMVFVzl1+qPz1AgMBAAGjggTvMIIE6zAfBgNVHSMEGDAWgBSNjF7E VK2K4Xfpm/mbBeG4AY1h4TAdBgNVHQ4EFgQU3SQkfaoTlUaHdQG8YlDEJJ3LmkIw DgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUH AwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEF BQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEF BQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2Vj dGlnb1JTQURvbWFpblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcnQwIwYIKwYB BQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMIIBAwYKKwYBBAHWeQIEAgSB 9ASB8QDvAHUAfT7y+I//iFVoJMLAyp5SiXkrxQ54CX8uapdomX4i8NcAAAF1QGws EQAABAMARjBEAiBVx0PrXrRxj6SIh9LGky6vmRkrbGkXukWEK6KsVpVZdwIgBLJ/ MURzXMyJDY1LvctAg+7MW24DTjEazHJ+OeL4KyIAdgCUILwejtWNbIhzH4KLIiwN 0dpNXmxPlD1h204vWE2iwgAAAXVAbCw7AAAEAwBHMEUCIQCseMcMcDnqcOAhxkZ4 nxusnNQkzxUm9Zlyre5NAoRxlwIgC76L67KAcv0ulaklKJJb4v/1TNjY0o85m9Ga NhcvOgQwggKRBgNVHREEggKIMIIChIITd3d3LnZvZGFmb25lbWFpbC5kZYIVYXV0 b2Rpc2NvdmVyLmFyY29yLmRlghlhdXRvZGlzY292ZXIua2FiZWxtYWlsLmRlghhh dXRvZGlzY292ZXIudm9kYWZvbmUuZGWCHGF1dG9kaXNjb3Zlci52b2RhZm9uZW1h aWwuZGWCDWltYXAuYXJjb3IuZGWCEWltYXAua2FiZWxtYWlsLmRlghBpbWFwLnZv ZGFmb25lLmRlghRpbWFwLnZvZGFmb25lbWFpbC5kZYIVbG9naW4udm9kYWZvbmVt YWlsLmRlgg1tYWlsLmFyY29yLmRlghBtYWlsLnZvZGFmb25lLmRlghNteDEudm9k YWZvbmVtYWlsLmRlghNteDIudm9kYWZvbmVtYWlsLmRlghNteDMudm9kYWZvbmVt YWlsLmRlghNteDQudm9kYWZvbmVtYWlsLmRlggxwb3AuYXJjb3IuZGWCD3BvcC52 b2RhZm9uZS5kZYITcG9wLnZvZGFmb25lbWFpbC5kZYINcG9wMy5hcmNvci5kZYIR cG9wMy5rYWJlbG1haWwuZGWCEHBvcDMudm9kYWZvbmUuZGWCFHBvcDMudm9kYWZv bmVtYWlsLmRlgg1zbXRwLmFyY29yLmRlghFzbXRwLmthYmVsbWFpbC5kZYIQc210 cC52b2RhZm9uZS5kZYIUc210cC52b2RhZm9uZW1haWwuZGWCEHNzby5rYWJlbG1h aWwuZGWCE3dlYmRhdi5rYWJlbG1haWwuZGWCFndlYmRhdi52b2RhZm9uZW1haWwu ZGWCFHdpa2kudm9kYWZvbmVtYWlsLmRlghB3d3cua2FiZWxtYWlsLmRlMA0GCSqG SIb3DQEBCwUAA4IBAQAaRpwtomQFeU/oS7Cg56NHLNTJ82t9TRQeqUrvkA9Pc2ci sVJmV6/t3I5R/LrmZ0Nn1AVfsoQKAo8om8MoKJMmpi5VgjAB57DnMMTGgdC2vfz5 LeR0AsB9TjOZC0MZLeBXRYRzgk1g3OIkVyhiNU1wh2KvYCMuoX9UVnMldodgZAuc 1EfqHZTZ/Phyun2xmPhaSebZcz1ReYaED8xOGQwxztkEXIm/JMnMfYEkJ1OmoHje xYTNn4nMeweTxwi/2eSf0b5zmXkp4gMnkcgAH5iZEgDb3FGOVo/PjShh2lEKLxqe wsT526yJ8ap+u2KmPmJe3Z6PiazpkgxNrAhdmMLU -----END CERTIFICATE----- --- Server certificate subject=CN = www.vodafonemail.de issuer=C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA --8<---------------cut here---------------end--------------->8--- The interesting thing is that both kmail and Firefox don't seem to have that problem and follow the chain to the trust anchor, but Emacs (via gnutls) and openssl (as shown above) fail to verify the start of the cert chain and error out. What's going on here? Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ Factory and User Sound Singles for Waldorf Blofeld: http://Synth.Stromeko.net/Downloads.html#WaldorfSounds