Re: [SM-USERS] Problem with STARTTLS

2018-04-30 Thread James B. Byrne via squirrelmail-users
On Sat, April 28, 2018 14:45, Paul Lesniewski wrote: > > Off the top of my head, I'd suggest trying to write a small POC > script to see if you can make the connection without any other > code in the way. But it does seem clear that the IMAP server does > not in fact have the CA's certificate, de

Re: [SM-USERS] Problem with STARTTLS

2018-04-30 Thread Paul Lesniewski
On Mon, April 30, 2018 3:46 pm, James B. Byrne wrote: > > On Sat, April 28, 2018 14:45, Paul Lesniewski wrote: > >> >> Off the top of my head, I'd suggest trying to write a small POC >> script to see if you can make the connection without any other >> code in the way. But it does seem clear that

[SM-USERS] SQM-1.5 check security Cookie httponly flag

2018-04-30 Thread hlmob16
Hallo, Our services must pass a scan test. Nikto say: + GET Cookie SQMSESSID created without the httponly flag I have not found a config option. I found following function: # vi ./functions/global.php 589 function sqsetcookie($sName, $sValue='deleted', $iExpire=0, $sPath="", $sDomain="",

Re: [SM-USERS] Problem with STARTTLS

2018-04-30 Thread James B. Byrne via squirrelmail-users
On Mon, April 30, 2018 13:22, Paul Lesniewski wrote: >> Verify return code: 19 (self signed certificate in certificate >> chain) > > That's likely your problem - SquirrelMail needs the homebrewed CA or > you need to adjust the verify options. > That message is completely misleading. Every C

Re: [SM-USERS] SQM-1.5 check security Cookie httponly flag

2018-04-30 Thread Paul Lesniewski
On 2018年04月24日 13:01, hlmo...@freenet.de wrote: > > Hallo, > > Our services must pass a scan test. > Nikto say: > > + GET Cookie SQMSESSID created without the httponly flag > > I have not found a config option. > > I found following function: > > # vi ./functions/global.php > 589 functi