Trying to get Bridge running with Agent... I got outbound working, but
inbound gives me the error "Unable to negotiate an SSL connection with
server 127.0.0.1 (error 80090308)".

On Sun, 28 May 2023 17:41:28 -0400, happy camper wrote:

> Trying to get Bridge running with Agent... I got outbound working, but
> inbound gives me the error "Unable to negotiate an SSL connection with
> server 127.0.0.1 (error 80090308)".

It appears ProtonMail Bridge wants Agent to connect to it with STARTTLS,
based on its set-up instructions for several other mail clients.

Agent supports STARTTLS for outbound email connections, but not for
inbound email connections.

To explain:

* STARTTLS is where your mail program first connects to the bridge
or server insecurely (with no encryption). Your program then
sends a command to the bridge or server (over that insecure
connection) to convert the connection to a secure (encrypted)
connection.
* In Agent, the inbound email server settings has a simple check-box
for connection security. When the check-box is checked, Agent
will connect securely from the start (implicit SSL/TLS), not in
the way STARTTLS works.

ProtonMail Bridge issue #245 "Support tunning off STARTTLS for localhost"
is now closed. See if that provides any help.
<https://github.com/ProtonMail/proton-bridge/issues/245>

Failing that, here are a couple of things you might want to try although
I cannot say whether these would fix the problem.

1) Make a small configuration change to Agent, as described in this message.

* <https://groups.google.com/g/alt.usenet.offline-reader.forte-agent/c/mJmtMSUqp6M>
* <https://alt.usenet.offline-reader.forte-agent.narkive.com/35h3yv8s/notice-agent-and-ssl>
* <news:p8hpuglnb0tot2oot3ob7m8n1k940kfgcl@4ax.com>

2) Try turning off "The server requires a secure connection (SSL)"
to see if ProtonMail Bridge will work with an insecure connection
for inbound email. The connection between Agent and ProtonMail
Bridge at 127.0.0.1:1143 is entirely within your own computer and
is unlikely to be intercepted.

--
Kind regards
Ralph

一橹抵三桨

On Mon, 29 May 2023 18:46:11 +1200, Ralph Fox <-rf-nz-@-.invalid>
wrote:

>On Sun, 28 May 2023 17:41:28 -0400, happy camper wrote:
>
>> Trying to get Bridge running with Agent... I got outbound working, but
>> inbound gives me the error "Unable to negotiate an SSL connection with
>> server 127.0.0.1 (error 80090308)".
>
>
>It appears ProtonMail Bridge wants Agent to connect to it with STARTTLS,
>based on its set-up instructions for several other mail clients.
>
>Agent supports STARTTLS for outbound email connections, but not for
>inbound email connections.
>
>To explain:
>
> * STARTTLS is where your mail program first connects to the bridge
> or server insecurely (with no encryption). Your program then
> sends a command to the bridge or server (over that insecure
> connection) to convert the connection to a secure (encrypted)
> connection.
> * In Agent, the inbound email server settings has a simple check-box
> for connection security. When the check-box is checked, Agent
> will connect securely from the start (implicit SSL/TLS), not in
> the way STARTTLS works.
>
>
>ProtonMail Bridge issue #245 "Support tunning off STARTTLS for localhost"
>is now closed. See if that provides any help.
><https://github.com/ProtonMail/proton-bridge/issues/245>

Have not dug into Let's Encrypt yet. Yikes.

>Failing that, here are a couple of things you might want to try although
>I cannot say whether these would fix the problem.
>
> 1) Make a small configuration change to Agent, as described in this message.
>
> * <https://groups.google.com/g/alt.usenet.offline-reader.forte-agent/c/mJmtMSUqp6M>
> * <https://alt.usenet.offline-reader.forte-agent.narkive.com/35h3yv8s/notice-agent-and-ssl>
> * <news:p8hpuglnb0tot2oot3ob7m8n1k940kfgcl@4ax.com>

I was set up at 2688 on Win10 2H22 19045, so I changed that to 10880.

> 2) Try turning off "The server requires a secure connection (SSL)"
> to see if ProtonMail Bridge will work with an insecure connection
> for inbound email. The connection between Agent and ProtonMail
> Bridge at 127.0.0.1:1143 is entirely within your own computer and
> is unlikely to be intercepted.

Turning off SSL generates "Error reported by server 220 127.0.0.1
ESMTP Service Ready", and no email is received.

On Mon, 29 May 2023 08:05:33 -0400, happy camper wrote:
> On Mon, 29 May 2023 18:46:11 +1200, Ralph Fox <-rf-nz-@-.invalid> wrote:
>> On Sun, 28 May 2023 17:41:28 -0400, happy camper wrote:
>>
>>> Trying to get Bridge running with Agent... I got outbound working, but
>>> inbound gives me the error "Unable to negotiate an SSL connection with
>>> server 127.0.0.1 (error 80090308)".
>>
>>
>> It appears ProtonMail Bridge wants Agent to connect to it with STARTTLS,
>> based on its set-up instructions for several other mail clients.
>>
>> Agent supports STARTTLS for outbound email connections, but not for
>> inbound email connections.
>>
>> To explain:
>>
>> * STARTTLS is where your mail program first connects to the bridge
>> or server insecurely (with no encryption). Your program then
>> sends a command to the bridge or server (over that insecure
>> connection) to convert the connection to a secure (encrypted)
>> connection.
>> * In Agent, the inbound email server settings has a simple check-box
>> for connection security. When the check-box is checked, Agent
>> will connect securely from the start (implicit SSL/TLS), not in
>> the way STARTTLS works.
>>
>>
>> ProtonMail Bridge issue #245 "Support tunning off STARTTLS for localhost"
>> is now closed. See if that provides any help.
>> <https://github.com/ProtonMail/proton-bridge/issues/245>
>
> Have not dug into Let's Encrypt yet. Yikes.

Let's Encrypt is a side issue, and is not relevant to this problem.

What is relevant is whether ProtonMail Bridge now has an option to
turn off the need for STARTTLS. If it does, you might be able to
fix the problem by turning off STARTTLS in ProtonMail Bridge.

>> Failing that, here are a couple of things you might want to try although
>> I cannot say whether these would fix the problem.
>>
>> 1) Make a small configuration change to Agent, as described in this message.
>>
>> * <https://groups.google.com/g/alt.usenet.offline-reader.forte-agent/c/mJmtMSUqp6M>
>> * <https://alt.usenet.offline-reader.forte-agent.narkive.com/35h3yv8s/notice-agent-and-ssl>
>> * <news:p8hpuglnb0tot2oot3ob7m8n1k940kfgcl@4ax.com>
>
> I was set up at 2688 on Win10 2H22 19045, so I changed that to 10880.
>
>> 2) Try turning off "The server requires a secure connection (SSL)"
>> to see if ProtonMail Bridge will work with an insecure connection
>> for inbound email. The connection between Agent and ProtonMail
>> Bridge at 127.0.0.1:1143 is entirely within your own computer and
>> is unlikely to be intercepted.
>
> Turning off SSL generates "Error reported by server 220 127.0.0.1
> ESMTP Service Ready", and no email is received.

That is weird. That is the kind of error one would get if Agent's
inbound email server settings were set to the address/port of an
*outbound* mail server.

The message "220 127.0.0.1 ESMTP Service Ready" would be a success
response from an *outbound* mail server. When Agent tries to connect
to an _inbound_ email server it does not expect that kind of response
and will treat it like an error.

--
Kind regards
Ralph

𝗚𝗮𝗯𝗲𝗿𝗯𝗼𝗰𝗰𝗵𝘂𝘀
𝘏𝘰𝘳𝘢 𝘢𝘥𝘦𝘳𝘢𝘵 𝘣𝘳𝘪𝘭𝘪𝘨𝘪. 𝘕𝘶𝘯𝘤 𝘦𝘵 𝘚𝘭𝘺𝘵𝘩𝘪𝘢 𝘛𝘰𝘷𝘢 𝘗𝘭𝘶𝘳𝘪𝘮𝘢 𝘨𝘺𝘳𝘢𝘣𝘢𝘯𝘵 𝘨𝘺𝘮𝘣𝘰𝘭𝘪𝘵𝘢𝘳𝘦 𝘷𝘢𝘣𝘰;
𝘌𝘵 𝘉𝘰𝘳𝘰𝘨𝘰𝘷𝘰𝘳𝘶𝘮 𝘮𝘪𝘮𝘻𝘦𝘣𝘢𝘯𝘵 𝘶𝘯𝘥𝘪𝘲𝘶𝘦 𝘧𝘰𝘳𝘮𝘢𝘦, 𝘔𝘰𝘮𝘪𝘧𝘦𝘳𝘪𝘲𝘶𝘦 𝘰𝘮𝘯𝘦𝘴 𝘦𝘹𝘨𝘳𝘢𝘣𝘶𝘳𝘦 𝘙𝘢𝘵𝘩𝘪.

On Tue, 30 May 2023 18:11:28 +1200, Ralph Fox <-rf-nz-@-.invalid>
wrote:

>Let's Encrypt is a side issue, and is not relevant to this problem.
>
>What is relevant is whether ProtonMail Bridge now has an option to
>turn off the need for STARTTLS. If it does, you might be able to
>fix the problem by turning off STARTTLS in ProtonMail Bridge.

It does have that ability. It did not enable receeipt of email.

>> Turning off SSL generates "Error reported by server 220 127.0.0.1
>> ESMTP Service Ready", and no email is received.

>That is weird. That is the kind of error one would get if Agent's
>inbound email server settings were set to the address/port of an
>*outbound* mail server.
>
>The message "220 127.0.0.1 ESMTP Service Ready" would be a success
>response from an *outbound* mail server. When Agent tries to connect
>to an _inbound_ email server it does not expect that kind of response
>and will treat it like an error.

I tried a few options. None worked

server requires a secure connection
simple username and password
port 1025
ESMTP error

no SSL
simple username and password
port 1025
test hangs

server requires a secure connection
secure password authentication
port 1025
ESMTP error

On Wed, 31 May 2023 22:09:18 -0400, happy campe wrote:
> On Tue, 30 May 2023 18:11:28 +1200, Ralph Fox <-rf-nz-@-.invalid>
> wrote:
>> On Mon, 29 May 2023 08:05:33 -0400, happy camper wrote:
>
>>> Turning off SSL generates "Error reported by server 220 127.0.0.1
>>> ESMTP Service Ready", and no email is received.
>>
>> That is weird. That is the kind of error one would get if Agent's
>> inbound email server settings were set to the address/port of an
>> *outbound* mail server.
>>
>> The message "220 127.0.0.1 ESMTP Service Ready" would be a success
>> response from an *outbound* mail server. When Agent tries to connect
>> to an _inbound_ email server it does not expect that kind of response
>> and will treat it like an error.
>
> I tried a few options. None worked
>
> server requires a secure connection
> simple username and password
> port 1025
> ESMTP error

Port 1025 is a problem here.

Port 1025 is the port for sending _outbound_ email through ProtonMail Bridge
Port 1025 is _NOT_ the port for retrieving _inbound_ email through ProtonMail Bridge.

The "ESMTP" error you got is what happens when you configure Agent's _inbound_
email server settings to connect to an _outbound_ email port number.

> no SSL
> simple username and password
> port 1025
> test hangs
>
> server requires a secure connection
> secure password authentication
> port 1025
> ESMTP error

There are two types of _inbound_ email server, "POP" and "IMAP".
Most email service providers support both "POP" and "IMAP" for
your email account.

Agent only supports using "POP" inbound email.

You should configure Agent's inbound email server settings to use
the port for retrieving email via "POP" from ProtonMail Bridge,
assuming ProtonMail Bridge has a port for "POP".

If ProtonMail Bridge only allows you to retrieve email via "IMAP"
and not "POP", then you will not easily be able to get Agent to
retrieve email from ProtonMail Bridge.

--
Kind regards
Ralph

🐘🍵🍽🏪