Re: [gentoo-user] [OT] Strange behaviour of google certificates.

[Gevisz <gevisz@gmail.com>]

On Thu, 2 Apr 2015 03:52:40 -0400 "Walter Dnes" <waltdnes@waltdnes.org> wrote:

> On Wed, Apr 01, 2015 at 08:19:45PM +0300, Gevisz wrote
> 
> > So, I am using Claws Mail that downloads e-mails from several
> > google mail accounts (all are mine :) and about once or twice
> > in a month get into the situation when Claws asks me to verify
> > and change the google certificates, first in one direction and
> > soon after that (usually during the next downloading of my e-mails)
> > - in another.
> > 
> > The situation is illustrated by the 2 message screenshots that are
> > attached to this e-mail.
> > 
> > The strange thing for me is that, first, the Claws asks me to verify
> > and accept a newer certificate complaing that the old one is in some
> > aspect "bad", and soon after that it complains about a newer
> > certificate and asks me to verify and and accept the older one.
> > 
> > I suspect that it is google that makes something wrong here.
> > 
> > What do you think?
> 
>   The same question came up on the local linux user group here in
> Toronto.  Apparently "pop.gnail.com" is actually 2 servers...
> 
> [d531][waltdnes][~] nslookup pop.gmail.com
> Server:         206.248.154.170
> Address:        206.248.154.170#53
> 
> Non-authoritative answer:
> pop.gmail.com   canonical name = gmail-pop.l.google.com.
> Name:   gmail-pop.l.google.com
> Address: 173.194.192.108
> Name:   gmail-pop.l.google.com
> Address: 173.194.192.109
> 
>   The 2 servers probably have different certificates, which is why you
> get this behaviour.  I suggest going into "apk mode" and putting an
> entry into your hosts file <G>, like...
> 
> 173.194.192.108     pop.gmail.com
> 
>   This will force your system to always use the same server, and avoid
> the re-validation every time you hit the other server from the one you
> used the previous time.

Thank you for your advice. Added that line to my /etc/hosts file.
After that Claws asked to verify the google certificate once again,
but I hope that that was the last time this month and that that madness
with google certificates finally ends. (Because in the last 2 days this
situation repeated at least 20 or more times.)