Subject: [TLS] Request for mail testserver with TLS accepting renegotiation

From: "Yngve N. Pettersen" <[email-masked]>
Date: Wed, 27 Jul 2011 01:55:05 +0200

Hello all,

I have recently upgraded my TLS Prober to test email servers (IMAP, POP,  
SMTP).

However, I am uncertain about whether the test for testing client  
initiated renegotiation works properly, particularly since a test of  
300000+ servers failed to detect a single email server that accepted it  
(or requested it).

It might of course be that all email servers have this functionality  
disabled, but for now I am assuming something is wrong about how the test  
itself works.

If anyone have an email server that is configured to accept client  
initiated renegotiation that I could test, I would appreciate it.

Thanks in advance.

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

---

From: Matt McCutchen <[email-masked]>
Date: Tue, 26 Jul 2011 20:05:22 -0400

> initiated renegotiation that I could test, I would appreciate it.

Is your test in any way specific to email protocols?  If you just run
"openssl s_server" interactively, it seems to accept all
client-initiated renegotiation by default (at least when renegotiation
indication is used).

-- 
Matt

---

From: "Yngve N. Pettersen" <[email-masked]>
Date: Wed, 27 Jul 2011 04:04:15 +0200

> client-initiated renegotiation by default (at least when renegotiation

I already know it works against HTTPS servers (which gives some  
problematic statistics for unpatched servers), but the tests against email  
servers follow a different pattern, since the email servers send content  
before the client send data, so there could be a difference in behavior.  
Possibilities include having to get the start line from the server before  
trying renegotiation, rather than try immediately.

While I might try configuring a OpenSSL testserver, I would prefer to test  
against the "real thing".

-- 
Sincerely,
Yngve N. Pettersen