Repository navigation
Apple SecTrust on second connection fails to get peer certificate #20435
Description
Activity
Okay, so here is the first log:
URL: imaps://mail.xxx.de/INBOX Host mail.xxx.de:993 was resolved. IPv6: (none) IPv4: 82.135.x.x Trying 82.135.x.x:993... TLSv1.3 (OUT), TLS handshake, Client hello (1): SSL Trust Anchors: Native: Apple SecTrust TLSv1.3 (IN), TLS handshake, Server hello (2): TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): TLSv1.3 (OUT), TLS handshake, Client hello (1): TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): TLSv1.3 (IN), TLS handshake, Server hello (2): TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): TLSv1.3 (IN), TLS handshake, Certificate (11): TLSv1.3 (IN), TLS handshake, CERT verify (15): TLSv1.3 (IN), TLS handshake, Finished (20): TLSv1.3 (OUT), TLS handshake, Finished (20): SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / RSASSA-PSS Server certificate: subject: CN=mail.xxx.de start date: Aug 15 00:00:00 2025 GMT expire date: Aug 15 23:59:59 2026 GMT issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=Thawte TLS RSA CA G1 Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption subjectAltName: "mail.xxx.de" matches cert's "mail.xxx.de" SSL certificate verified via Apple SecTrust. Established connection to mail.xxx.de (82.135.x.x port 993) from 192.168.9.45 port 65173 TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * OK Kerio Connect 10.0.8 patch 2 IMAP4rev1 server ready A001 CAPABILITY * CAPABILITY IMAP4 IMAP4rev1 IDLE ACL LITERAL+ UIDPLUS QUOTA ID SORT ANNOTATE ANNOTATEMORE STATUS-COUNTERS UNSELECT LISTEXT NAMESPACE XLIST SPECIAL-USE XAPPLEPUSHSERVICE AUTH=CRAM-MD5 AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 A001 OK CAPABILITY completed A002 AUTHENTICATE DIGEST-MD5 + ...== A002 OK Authentication successful A003 SELECT INBOX * FLAGS (\Deleted \Seen \Answered \Draft \Flagged $MDNSent $Forwarded $AutoJunk $AutoNotJunk $Junk $NotJunk) * 2 EXISTS * 0 RECENT * OK [UIDVALIDITY 1741956943] UID validity * OK [UIDNEXT 69] Predicted next UID * OK [PERMANENTFLAGS (\Deleted \Seen \Answered \Draft \Flagged $MDNSent $Forwarded $AutoJunk $AutoNotJunk $Junk $NotJunk)] Permanent flags A003 OK [READ-WRITE] SELECT completed A004 FETCH 1:* FLAGS * 1 FETCH (FLAGS (\Seen $NotJunk)) * 2 FETCH (FLAGS (\Seen $NotJunk)) A004 OK FETCH completed Connection #0 to host mail.xxx.de:993 left intactand the second call:
URL: imaps://mail.xxx.de/INBOX;UID=1 Reusing existing imaps: connection with host mail.xxx.de A005 UID FETCH 1 BODY[] A005 OK UID FETCH completed shutting down connection #0 Hostname mail.xxx.de was found in DNS cache Trying 82.135.x.x:993... SSL reusing session with ALPN '-' TLSv1.3 (OUT), TLS handshake, Client hello (1): SSL Trust Anchors: Native: Apple SecTrust TLSv1.3 (IN), TLS handshake, Server hello (2): TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): TLSv1.3 (OUT), TLS handshake, Client hello (1): TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): TLSv1.3 (IN), TLS handshake, Server hello (2): TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): TLSv1.3 (IN), TLS handshake, Finished (20): TLSv1.3 (OUT), TLS handshake, Finished (20): SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / UNDEF Server certificate: subject: CN=mail.xxx.de start date: Aug 15 00:00:00 2025 GMT expire date: Aug 15 23:59:59 2026 GMT issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=Thawte TLS RSA CA G1 subjectAltName: "mail.xxx.de" matches cert's "mail.xxx.de" SSL: could not get peer certificate SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) closing connection #1As you see the old connection died and it makes a new one. SSL is reused, but later it shows the certificate and reports the error.
Any idea?
I got it reproduced on my machine. You need to reuse the CURL connection. Workaround is to make a new one, but maybe still work fixing?
- New CURL session
- set user name
- set password
- set URL "imaps://mail.domain.de/INBOX"
- call Perform
- set URL "imaps://mail.domain.de/INBOX;UID=1"
- call Perform
and the second Perform fails.
Reusing existing imaps: connection with host mail.xxx.de A005 UID FETCH 1 BODY[] A005 OK UID FETCH completed shutting down connection #0 Hostname mail.xxx.de was found in DNS cache Trying 82.135.5.132:993... SSL reusing session with ALPN '-' TLSv1.3 (OUT), TLS handshake, Client hello (1): SSL Trust Anchors: Native: Apple SecTrust TLSv1.3 (IN), TLS handshake, Server hello (2): TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): TLSv1.3 (OUT), TLS handshake, Client hello (1): TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): TLSv1.3 (IN), TLS handshake, Server hello (2): TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): TLSv1.3 (IN), TLS handshake, Finished (20): TLSv1.3 (OUT), TLS handshake, Finished (20): SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / UNDEF Server certificate: subject: CN=mail.xxx.de start date: Aug 15 00:00:00 2025 GMT expire date: Aug 15 23:59:59 2026 GMT issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=Thawte TLS RSA CA G1 subjectAltName: "mail.xxx.de" matches cert's "mail.xxx.de" SSL: could not get peer certificate SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) closing connection #1Even if I forbid reuse on first connection or do fresh connect option, it still fails.
Looks worth fixing.
- added a commit that references this issue
on Jan 27, 2026 - added a commit that references this issue
on Jan 27, 2026 Seems to work. Thank you.
I did this
A client connects to an IMAP server with libCURL 8.18.0 in the application on macOS.
The first transfer works, but the second fails with a problem to get peer certificate.
I expected the following
No response
curl/libcurl version
libCURL 8.18.0
operating system
Curent macOS like 15.7.3