open-network-stream problems on W32 (was: [PATCH] GnuTLS support on Woe32)

[Ted Zlatanov <tzz@lifelogs.com>]

On Tue, 26 Apr 2011 21:57:13 -0600 Christoph Scholtes <cschol2112@googlemail.com> wrote: 

CS> On 4/26/2011 9:35 PM, Ted Zlatanov wrote:

>> It depends on what version of Gnus and Emacs you are using.  If you're
>> using the trunk version of both, I think you want (nnimap-stream ssl),
>> but I honestly don't remember all the permutations before then.

CS> Yes. I am using the trunk versions of both. `ssl' does not work, btw.

It should work, it's what I'm using.  Are you loading gnutls.el before
Gnus?

See `open-network-stream' for the code that Gnus is calling.  I changed
the subject and I hope that will get Lars and Chong's attention.

>> You can test that GnuTLS support works, in any case, with
>> 
>> (require 'gnutls)
>> (open-gnutls-stream "tls" "tls-buffer" "imap.gmail.com" "imaps")
>> 
>> Set `gnutls-log-level' to 1 to get details in *Messages*.

CS> I get this:

CS> gnutls.c: [1] (Emacs) allocating credentials
CS> gnutls.c: [1] (Emacs) gnutls callbacks
CS> gnutls.c: [1] (Emacs) gnutls_init
CS> gnutls.c: [1] (Emacs) got non-default priority string: NORMAL
CS> gnutls.c: [1] (Emacs) setting the priority string
CS> imap.gmail.com certificate could not be verified.
CS> gnutls.c: [1] (Emacs) certificate signer was not found: imap.gmail.com
CS> gnutls.c: [1] (Emacs) certificate validation failed: imap.gmail.com
CS> #<process tls>

CS> and

CS> * OK Gimap ready for requests from ...(my IP address I guess)

CS> in the tls-buffer.

CS> I am not sure if this means it is working or not.

This means that you established the connection but the SSL certificate
could not be verified (by default, not fatal because the `verify-error'
and `verify-hostname-error' parameters to `gnutls-negotiate' are nil by
default).

Chances are that the default certificate bundle,
/etc/ssl/certs/ca-certificates.crt, is not available on your system.  We
may have to attach this bundle to Emacs itself on W32 if there is
nothing suitable on the system (I would not depend on a Firefox or
Chrome or cygwin installation).  We should also set up a customizable
`gnutls-trustfiles' variable instead of the currently hard-coded string
in `gnutls-negotiate'.  But none of this should be breaking your
connection, the original problem you reported.

I won't be able to work on the bundle issue above for a few days so if
anyone else wants to do it, go ahead.

Ted