Hi,
It seems that smtplib doesn't check if a certificate is valid (signed by
a trusted CA).
For my personal usage, I patched the starttls code in git-multimail:
only for starttls with smtplib.
This patch is inspired from
https://github.com/graingert/secure-smtplib/blob/master/src/secure_smtplib/__init__.py
It could be easy to add support cert check in for smtps (see
secure_smtplib).
This patch was tested only on git-multimail (v1.2)
It introduces two new options:
- multimailhook.smtpcheckcert (default false)
- multimailhook.smtpcacerts (default
/etc/ssl/certs/ca-certificates.crt)
Best regards,
Simon P.