Python 3.9, does IMAP with TLS really require a certificate?

Python Help
1

My config: Python 3.9, Pycharm CE 2023.3.2, on Windows 10 Pro. I’m using Qt Designer and pyuic6 6.4.2. I’m new to Python and have not yet completed a 62 hour tutorial on Python. (I’m using Python 3.9 for the long tutorial I’m doing. I will upgrade Python later when I develop apps.)

I need to use a Microsoft IMAP email server to get and send emails with attachements, and the MS servers require TLS. One example from imap_tools/examples/tls.py at master · ikvk/imap_tools · GitHub shows an example using a certificate. But I don’t think we even have a certificate for anything.

  1. Is a certificate required to use IMAP in Python? Will our emails still be encrypted and meet MS standards?
  2. I’m having trouble finding documentation on imap_tools. How would I use no certificate in this line: ssl_context.load_cert_chain(certfile="./one.crt", keyfile="./one.key")
  3. Is it possible to get a free cert just to test if I can get email working in Python?

Thank you! You’ve all been very helpful.

EDIT: Sorry, the line of code above seems to come from the ssl package. Here’s the total code.

import ssl
from imap_tools import MailBoxTls

VER = "0.01"
APPTITLE = "app title"

"""
From https://github.com/ikvk/imap_tools/blob/master/examples/tls.py
If you want to use really secure connection, you MUST read this articles:

https://docs.python.org/3/library/imaplib.html#imaplib.IMAP4_SSL
https://docs.python.org/3/library/ssl.html#ssl-security
"""

ssl_context = ssl.create_default_context()
ssl_context.load_cert_chain(certfile="./one.crt", keyfile="./one.key")
with MailBoxTls('imap.server.com', ssl_context=ssl_context).login('user@mailbox.com', 'password', 'INBOX') as mailbox:
    for msg in mailbox.fetch():
        print("Subject: " + msg.subject, "Date: " + msg.date_str)
2

This answer might shed some light on the general question: encryption - Can we have https without certificates? - Information Security Stack Exchange. In general, yes, you can have encryption without certificates, but it is inherently not as safe as encryption with certificates, so it might not be allowed.

I sadly can’t help with the specifics.

3

I guess what I’m asking is does the code I posted above require a certificate? I’m having trouble finding code that does not use a certificate. I’m using Google to search for code.

But I did find documentation that says if no certificate is provided, the code will use the system certificates (I don’t know if I have access to those) and use reasonable encryption with TLS.

My requirement is I have to use TLS with the Microsoft IMAP server.

I should clarify that we are a small business and have 70+ virtual machines and managing a different certificate for each machine would be costly. I’m not in IT (our network operations dept with our sysadmins) so I don’t know what our email certificate policy is.

When I comment out the line that loads the certs:

import ssl
from imap_tools import MailBoxTls, AND
import time

VER = "0.01"
APPTITLE = "app title"

"""
From https://github.com/ikvk/imap_tools/blob/master/examples/tls.py
If you want to use really secure connection, you MUST read this articles:

https://docs.python.org/3/library/imaplib.html#imaplib.IMAP4_SSL
https://docs.python.org/3/library/ssl.html#ssl-security
"""
start_time = time.time()
ssl_context = ssl.create_default_context() # Uses reasonable cipher.
# ssl_context.load_cert_chain(certfile="", keyfile="")
print("Getting IMAP emails...")
with MailBoxTls('me.imapserver.com',
                ssl_context=ssl_context).login('user', 'passwd', 'INBOX') as mailbox:
    print("--- After login Time elapsed: %s seconds ---" % (time.time() - start_time))
    for msg in mailbox.fetch():
        print("Subject: " + msg.subject, "Date: " + msg.date_str)
print("--- Time elapsed: %s seconds ---" % (time.time() - start_time))

I get an error

"c:\users\MYUSER\AppData\Local\Programs\Python\Python39\lib\imaplib.py", line 1185, in _get_line
    raise self.abort('socket error: EOF')
imaplib.abort: socket error: EOF

I sent an email to our IT/sysadmin people to make sure the default IMAP port 993 is open for IMAP. Although this code does not specify the port.