From: Michal Sojka <sojkam1@fel.cvut.cz>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, notmuch@notmuchmail.org
Subject: Re: Long delay when opening signed emails
Date: Tue, 30 Jan 2018 21:47:47 +0100 [thread overview]
Message-ID: <87efm7qdjg.fsf@steelpick.2x.cz> (raw)
In-Reply-To: <87lggfb8fk.fsf@fifthhorseman.net>
On Tue, Jan 30 2018, Daniel Kahn Gillmor wrote:
> Hi Michal--
>
> On Tue 2018-01-30 17:17:54 +0100, Michal Sojka wrote:
>> Hi all,
>>
>> I experience annoyingly long delay, when opening some signed emails in
>> Emacs. This is likely related to the following lines appearing in my
>> log when opening the email:
>>
>> Jan 30 17:07:46 dirmngr[7526]: no CRL available for issuer id A401B7A860C859FEA90E1A7EEE2BAF37C7FB918F
>> Jan 30 17:08:06 dirmngr[7526]: resolving 'crl3.digicert.com' failed: Server indicated a failure
>> Jan 30 17:08:06 dirmngr[7526]: can't connect to 'crl3.digicert.com': host not found
>> Jan 30 17:08:06 dirmngr[7526]: error retrieving 'http://crl3.digicert.com/TERENAeSciencePersonalCA3.crl': Server indicated a failure
>> Jan 30 17:08:06 dirmngr[7526]: crl_fetch via DP failed: Server indicated a failure
>> Jan 30 17:08:06 dirmngr[7526]: command 'ISVALID' failed: Server indicated a failure
>>
>> I don't understand why resolving crl3.digicert.com fails, because it
>> works from command line.
>
> I think the e-mail in question is S/MIME-signed. is that right?
Yes, that's correct.
> It looks like dirmngr is having some problems with network connectivity
> -- perhaps it has the wrong information about DNS resolvers?
>
> as a workaround, have you tried terminating dirmngr to let it restart
> when needed? you can do that with:
>
> gpgconf --kill dirmngr
>
> (it should respawn automatically as needed)
That didn't help.
>> Any suggestions how to solve the failure or at least to get rid of the
>> delay?
>
> Apart from the workaround described above, if you decide that you'd
> rather avoid doing CRL checks in general (you might want that to avoid
> metadata leakage at least), you could put "disable-crl-checks" on its
> own line in ~/.gnupg/gpgsm.conf
Perfect, that prevents the delays.
> See also https://dev.gnupg.org/T3348 -- i'm asking upstream to default
> to False there.
Hmm, now I see that my problem is probably the same as in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842291 referenced from
your GPG bug report.
Thank you.
-Michal
prev parent reply other threads:[~2018-01-30 20:55 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-30 16:17 Long delay when opening signed emails Michal Sojka
2018-01-30 16:47 ` Daniel Kahn Gillmor
2018-01-30 20:47 ` Michal Sojka [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://notmuchmail.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87efm7qdjg.fsf@steelpick.2x.cz \
--to=sojkam1@fel.cvut.cz \
--cc=dkg@fifthhorseman.net \
--cc=notmuch@notmuchmail.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).