title: getting correct certificate info for offlineimap from outlook imap server
body: <p>I'm trying to use offlineimap to download Outlook.com messages, but can't seem to get the security correct (I use offlineimap successfully for other IMAP accounts as well). In .offlineimaprc, in the remote repository section, I've put:</p>
  
  <pre><code>[Repository remoteOutlook]
  type = IMAP
  remotehost = imap-mail.outlook.com
  ssl = yes 
  cert_fingerprint = c914dd966dbd0912c36ec294f83d8d3b5a434729
  remoteport = 993
  remoteuser = &lt;hidden&gt;
  remotepass = &lt;hidden&gt;
  </code></pre>
  
  <p>The fingerprint was captured using gnutls-cli, as follows:</p>
  
  <pre><code>$ gnutls-cli -p 993 imap-mail.outlook.com
  Processed 168 CA certificate(s).
  Resolving 'imap-mail.outlook.com'...
  Connecting to '157.56.195.250:993'...
  - Certificate type: X.509
  - Got a certificate list of 2 certificates.
  - Certificate[0] info:
   - subject `C=US,ST=Washington,L=Redmond,O=Microsoft Corporation,CN=*.hotmail.com', issuer `C=BE,O=GlobalSign nv-sa,CN=GlobalSign Organization Validation CA - SHA256 - G2', RSA key 2048 bits, signed using RSA-SHA256, activated `2015-12-15 22:26:11 UTC', expires `2016-12-15 22:26:11 UTC', SHA-1 fingerprint `c914dd966dbd0912c36ec294f83d8d3b5a434729'
          Public Key ID:
                  e74e1f5a4a2656b5bbf73ae68e293e43a0846941
          Public key's random art:
                  +--[ RSA 2048]----+
                  |   .E            |
                  |    .            |
                  |     +      .    |
                  |    + . .  . .   |
                  |   . . .S.o .    |
                  |      .  +.  .   |
                  |        o.= +    |
                  |       . *+= =+  |
                  |         .=+==++.|
                  +-----------------+
  
  - Certificate[1] info:
   - subject `C=BE,O=GlobalSign nv-sa,CN=GlobalSign Organization Validation CA - SHA256 - G2', issuer `C=BE,O=GlobalSign nv-sa,OU=Root CA,CN=GlobalSign Root CA', RSA key 2048 bits, signed using RSA-SHA256, activated `2014-02-20 10:00:00 UTC', expires `2024-02-20 10:00:00 UTC', SHA-1 fingerprint `902ef2deeb3c5b13ea4c3d5193629309e231ae55'
  - Status: The certificate is trusted. 
  - Description: (TLS1.0)-(ECDHE-RSA-SECP384R1)-(AES-256-CBC)-(SHA1)
  - Session ID: 82:4B:00:00:4D:3C:F0:07:B9:B1:49:21:9F:95:99:A9:8B:E4:A7:44:21:6F:06:F6:15:6D:76:F5:F6:3F:4C:97
  - Ephemeral EC Diffie-Hellman parameters
   - Using curve: SECP384R1
   - Curve size: 384 bits
  - Version: TLS1.0
  - Key Exchange: ECDHE-RSA
  - Cipher: AES-256-CBC
  - MAC: SHA1
  - Compression: NULL
  - Options: extended master secret, safe renegotiation,
  - Handshake was completed
  
  - Simple Client Mode:
  
  * OK Outlook.com IMAP4rev1 server version 17.4.0.0 ready (DUB451-IMAP396)
  *** Fatal error: The TLS connection was non-properly terminated.
  *** Server has terminated the connection abnormally.
  </code></pre>
  
  <p>This output shows two certificates (0 and 1), with respective SHA1 fingerprints,</p>
  
  <pre><code>c914dd966dbd0912c36ec294f83d8d3b5a434729
  902ef2deeb3c5b13ea4c3d5193629309e231ae55
  </code></pre>
  
  <p>If I use the first one (as shown in .offlineimaprc above), offlineimap fails to authenticate correctly, and the response is "BAD ['SASL Token argument is missing or invalid.']":</p>
  
  <pre><code>$ offlineimap -o
  XOAUTH2 authentication failed: AUTHENTICATE command error: BAD ['SASL Token argument is missing or invalid.']. Data: FBPH2 AUTHENTICATE XOAUTH2
  
  PLAIN authentication failed: [AUTHENTICATIONFAILED] Invalid username or password.
  LOGIN authentication failed: [AUTHENTICATIONFAILED] Invalid username or password.
  ERROR: All authentication types failed:
          XOAUTH2: AUTHENTICATE command error: BAD ['SASL Token argument is missing or invalid.']. Data: FBPH2 AUTHENTICATE XOAUTH2
  
          PLAIN: [AUTHENTICATIONFAILED] Invalid username or password.
          LOGIN: [AUTHENTICATIONFAILED] Invalid username or password.
  ERROR: Exceptions occurred during the run!
  ERROR: All authentication types failed:
          XOAUTH2: AUTHENTICATE command error: BAD ['SASL Token argument is missing or invalid.']. Data: FBPH2 AUTHENTICATE XOAUTH2
  
          PLAIN: [AUTHENTICATIONFAILED] Invalid username or password.
          LOGIN: [AUTHENTICATIONFAILED] Invalid username or password.
  
  Traceback:
    File "/usr/lib64/python2.7/site-packages/offlineimap/accounts.py", line 271, in syncrunner
      self.__sync()
    File "/usr/lib64/python2.7/site-packages/offlineimap/accounts.py", line 334, in __sync
      remoterepos.getfolders()
    File "/usr/lib64/python2.7/site-packages/offlineimap/repository/IMAP.py", line 448, in getfolders
      imapobj = self.imapserver.acquireconnection()
    File "/usr/lib64/python2.7/site-packages/offlineimap/imapserver.py", line 525, in acquireconnection
      self.__authn_helper(imapobj)
    File "/usr/lib64/python2.7/site-packages/offlineimap/imapserver.py", line 437, in __authn_helper
      "failed:\n\t%s"% msg, OfflineImapError.ERROR.REPO)
  </code></pre>
  
  <p>Alternatively, if I use the second, offlineimap reports that actually the first fingerprint is the one that the outlook server uses, but as shown previously that one fails, insisting that the username/password is bad.</p>
  
  <pre><code>$ offlineimap -o
  ERROR: Server SSL fingerprint 'c914dd966dbd0912c36ec294f83d8d3b5a434729' for hostname 'imap-mail.outlook.com' does not match configured fingerprint(s) ['902ef2deeb3c5b13ea4c3d5193629309e231ae55'].  Please verify and set 'cert_fingerprint' accordingly if not set yet.
  ERROR: Exceptions occurred during the run!
  ERROR: Server SSL fingerprint 'c914dd966dbd0912c36ec294f83d8d3b5a434729' for hostname 'imap-mail.outlook.com' does not match configured fingerprint(s) ['902ef2deeb3c5b13ea4c3d5193629309e231ae55'].  Please verify and set 'cert_fingerprint' accordingly if not set yet.
  
  Traceback:
    File "/usr/lib64/python2.7/site-packages/offlineimap/accounts.py", line 271, in syncrunner
      self.__sync()
    File "/usr/lib64/python2.7/site-packages/offlineimap/accounts.py", line 334, in __sync
      remoterepos.getfolders()
    File "/usr/lib64/python2.7/site-packages/offlineimap/repository/IMAP.py", line 448, in getfolders
      imapobj = self.imapserver.acquireconnection()
    File "/usr/lib64/python2.7/site-packages/offlineimap/imapserver.py", line 511, in acquireconnection
      af=self.af,
    File "/usr/lib64/python2.7/site-packages/offlineimap/imaplibutil.py", line 194, in __init__
      super(WrappedIMAP4_SSL, self).__init__(*args, **kwargs)
    File "/usr/lib64/python2.7/site-packages/offlineimap/bundled_imaplib2.py", line 2135, in __init__
      IMAP4.__init__(self, host, port, debug, debug_file, identifier, timeout, debug_buf_lvl)
    File "/usr/lib64/python2.7/site-packages/offlineimap/bundled_imaplib2.py", line 357, in __init__
      self.open(host, port)
    File "/usr/lib64/python2.7/site-packages/offlineimap/imaplibutil.py", line 213, in open
      OfflineImapError.ERROR.REPO)
  </code></pre>
  
  <p>I've checked username and password several times (I use the same setup in mutt, and this works fine in terms of accessing the outlook IMAP server). Can anyone tell me what I might be doing incorrectly?</p>