[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1018)

[jgsuk]

I've just set up emailproxy on my Windows 11 computer.
Installation was fine but I get the error message as per the title.
The full window is shown below (I hope I've done that correctly!):

Also the relevant details from the config file (I'm using SMTP to Office 365) are:

[SMTP-1587]
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
server_address = smtp-mail.outlook.com
server_port = 587
server_starttls = True
local_address = 127.0.0.1

and

[[email protected]]
permission_url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/common/oauth2/v2.0/token
oauth2_scope = https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access
redirect_uri = http://localhost
client_id = my client id

Also, I don't get a menu bar/taskbar icon.

I'm totally new to Python, but I think that the installationn is fine.
It looks like there are issues with the certificate.

Thanks,
Geoff

[jgsuk]

This is not an answer, but a follow up to my original question.

I have made various changes to my app, and the above error does not occur, but now I get the following:

2025-02-06 10:04:31,351: Initialising Email OAuth 2.0 Proxy (version 2025-02-04) from config file C:\emailproxy\emailproxy.config
2025-02-06 10:04:31,354: Starting IMAP server at 127.0.0.1:1993 (unsecured) proxying outlook.office365.com:993 (SSL/TLS)
2025-02-06 10:04:31,364: Starting POP server at 127.0.0.1:1995 (unsecured) proxying outlook.office365.com:995 (SSL/TLS)
2025-02-06 10:04:31,365: Starting SMTP server at 127.0.0.1:1587 (unsecured) proxying smtp-mail.outlook.com:587 (SSL/TLS)
2025-02-06 10:04:31,367: Initialised Email OAuth 2.0 Proxy - listening for authentication requests. Connect your email client to begin
2025-02-06 10:04:44,479: Accepting new connection from 127.0.0.1:59732 to SMTP server at 127.0.0.1:1587 (unsecured) proxying smtp-mail.outlook.com:587 (SSL/TLS)
2025-02-06 10:04:44,613: SMTP (127.0.0.1:1587) Caught network error (server) - is there a network connection? Error type <class 'ConnectionResetError'> with message: [WinError 10054] An existing connection was forcibly closed by the remote host

I am very new to this, so there may be a very simple answer.

Thanks,
Geoff

[simonrob]

Could you try #321 and see if that fixes things for you?

It would also help if you could explain what you mean by "various changes to my app". Is this changing the code, or just the configuration file? Or something else? The more detail you can provide (including code where relevant) the better.

[jgsuk]

Thank you Simon.

However, I am now back to the position detailed in my original post - i.e. Certificate problem.
My application is a general business support application (handling Sales and Purchase Orders). One of its features is to enable users to email the various documents (Order Acknowledgements, Invoices, etc.) directly from within my application. I use the Sockettools library to handle this. I have written code to work with Microsoft Outlook using OAuth2, but I found this change onerous, and was looking to use a third party tool, such as yours, to avoid me needing to futher maintain/develop my code. I am sure that emailproxy will enable me to do this but I have to overcome a few inital hurdles. My application changes have been in terms of trying to send Certificate information, but, presumbly, this is the domain of emailproxy.

Again, as per my intial query, I do not see the menu bar/taskbar icon, hence I am unable to login using my email address and password. I have now loaded an earlier version of Python (3.13 rather than 3.13.2), as per your suggestion re Pythonnet - but still no pop up. Should I go back further?

Thanks again.

Regards,
Geoff

P.S. Nice to see these developments in the UK.

[jgsuk]

Further info:

1. There is a taskbar icon - it was hidden! So that's not a problem.

2. Using the taskbar icon, I turned on debug mode, and got the following (not saure if it helps):

2025-02-08 12:25:51: Initialising Email OAuth 2.0 Proxy (version 2025-02-04) from config file C:\emailproxy\emailproxy.config
2025-02-08 12:25:51: Starting IMAP server at 127.0.0.1:1993 (unsecured) proxying outlook.office365.com:993 (SSL/TLS)
2025-02-08 12:25:51: Starting POP server at 127.0.0.1:1995 (unsecured) proxying outlook.office365.com:995 (SSL/TLS)
2025-02-08 12:25:51: Starting SMTP server at 127.0.0.1:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-02-08 12:25:51: Initialised Email OAuth 2.0 Proxy - listening for authentication requests. Connect your email client to begin
2025-02-08 12:27:28: Accepting new connection from 127.0.0.1:50354 to SMTP server at 127.0.0.1:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-02-08 12:27:28: Caught connection error in SMTP (127.0.0.1:1587) : <class 'ssl.SSLCertVerificationError'> with message: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1020)
2025-02-08 12:27:28: Are the server's local_starttls and server_starttls settings correct? Current local_starttls value: False; current server_starttls value: True
2025-02-08 12:27:28: If you encounter this error repeatedly, please check that you have correctly configured python root certificates; see: #14
2025-02-08 12:38:27: Setting debug mode: True
2025-02-08 12:38:45: New incoming connection to SMTP server at 127.0.0.1:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-02-08 12:38:45: Accepting new connection from 127.0.0.1:50466 to SMTP server at 127.0.0.1:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-02-08 12:38:45: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) --> [ Client connected ]
2025-02-08 12:38:45: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) <-- b'220 LO4P123CA0155.outlook.office365.com Microsoft ESMTP MAIL Service ready at Sat, 8 Feb 2025 12:38:41 +0000 [08DD47C9B087D870]\r\n'
2025-02-08 12:38:45: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) <-- b'220 LO4P123CA0155.outlook.office365.com Microsoft ESMTP MAIL Service ready at Sat, 8 Feb 2025 12:38:41 +0000 [08DD47C9B087D870]\r\n'
2025-02-08 12:38:45: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) --> b'HELO Geekom\r\n'
2025-02-08 12:38:45: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) --> b'HELO Geekom\r\n'
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) <-- b'250 LO4P123CA0155.outlook.office365.com Hello [31.94.60.60]\r\n'
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) --> b'STARTTLS\r\n'
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) <-- b'220 2.0.0 SMTP server ready\r\n'
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) <-> [ Starting TLS handshake ]
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) [ Successfully negotiated SMTP server STARTTLS connection - re-sending greeting ]
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) --> b'HELO Geekom\r\n'
2025-02-08 12:38:46: Caught connection error in SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) : <class 'ssl.SSLCertVerificationError'> with message: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1020)
2025-02-08 12:38:46: Are the server's local_starttls and server_starttls settings correct? Current local_starttls value: False; current server_starttls value: True
2025-02-08 12:38:46: If you encounter this error repeatedly, please check that you have correctly configured python root certificates; see: #14
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) <-- [ Server disconnected ]
2025-02-08 12:38:46: SMTP (127.0.0.1:50466-{127.0.0.1:1587}-smtp-mail.outlook.com:587) --> [ Client disconnected ]

Also, I have looked at Issue 14, but I don't see Certificates.command anywhere - perhaps just a Mac fix.

Thanks,
Geoff

[jgsuk]

One further point:
I have tried using Thunderbird, and I get the same Certificate Error.

Geoff

[jgsuk]

I think that this may have a bearing on my problem:
https://stackoverflow.com/questions/79358216/python-v3-13-has-broken-email-delivery-due-to-an-ssl-change

The article is headed: Python 3.13 has broken email delivery due to an SSL change.

Regards,
Geoff