Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup OfflineIMAP to sync my Gmail account to ~/Mail/Gmail. I'm using a pretty basic ~/.offlineimaprc from here. But OfflineIMAP doesn't connect to Gmail at all. This is the debug message I'm getting (by running OfflineIMAP as offlineimap -o -d imap:

OfflineIMAP 6.3.4
Copyright 2002-2011 John Goerzen & contributors.
Licensed under the GNU GPL v2+ (v2 or any later version).

Debug mode: Forcing to singlethreaded.
Now debugging for imap: IMAP protocol debugging
Now debugging for : Other offlineimap related sync messages
Account sync Gmail:
***** Processing account Gmail
Copying folder structure from IMAP to Maildir
Establishing connection to imap.gmail.com:993.
DEBUG[imap]:   06:28.69 Account sync Gmail imaplib2 version 2.24
DEBUG[imap]:   06:28.69 Account sync Gmail imaplib2 debug level 5, buffer level 3
WARNING: Error occured attempting to sync account 'Gmail':
Traceback (most recent call last):
File "/usr/lib/pymodules/python2.7/offlineimap/accounts.py", line 177, in syncrunner
File "/usr/lib/pymodules/python2.7/offlineimap/accounts.py", line 235, in sync
    remoterepos.syncfoldersto(localrepos, [statusrepos])
File "/usr/lib/pymodules/python2.7/offlineimap/repository/Base.py", line 124, in syncfoldersto
    srcfolders = src.getfolders()
File "/usr/lib/pymodules/python2.7/offlineimap/repository/IMAP.py", line 276, in getfolders
    imapobj = self.imapserver.acquireconnection()
File "/usr/lib/pymodules/python2.7/offlineimap/imapserver.py", line 323, in acquireconnection
    elif isinstance(e, socket.error) and e.args[0] == errno.ECONNREFUSED:
NameError: global name 'errno' is not defined

***** Finished processing account Gmail

In the beginning I thought this could be due to my ISP blocking imap.gmail.com/imap.googlemail.com, but I'm able to connect to it using telnet imap.googlemail.com 993:

telnet imap.googlemail.com 993
Connected to googlemail-imap.l.google.com.
Escape character is '^]'.

Any ideas?

EDIT 1: From this answer on SuperUser, I tried connecting to imap.googlemail.com via SSL using openssl s_client -connect imap.googlemail.com:993. This gives me:

3078125768:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 226 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

This looks like a missing certificate problem in OpenSSL. Could the same be happening to OfflineIMAP too?

EDIT 2: I tried the same OpenSSL commands on another server (on the same network) running Mandriva Linux release 2009.1 and apparently the connection worked (debug output). I'm running Ubuntu 12.04 with OpenSSL/LibSSL 1.0.1-4ubuntu5.5. Could this be distro related?

share|improve this question
It may help to post your offlineimap version, as that project has quite a few versions in the wild and some of them are badly broken. Try also their mailing list, whose info you can find on their home page. – jw013 Sep 11 '12 at 14:29

Instead of manually specifying the fingerprint (which can change), you can instead tell offlineimap where your local system certificates are stored and then have it automatically verify the chain.

[Repository somerepos-remote]
type = Gmail
sslcacertfile = /etc/ssl/certs/ca-certificates.crt

The sslcacertfile is what does the trick.

If non-Ubuntu users are seeing this, keep in mind that the location is most likely different on your distro.

share|improve this answer
any idea where the sslcacertfile path on OSX? – Meitham Aug 7 '14 at 21:18

You should add the following line to the section in .offlineimaprc describing your remote Gmail account:


This is the SSL cert of Gmail's imap server.

share|improve this answer

No, it's not OpenSSL missing a certificate it's a SSL handshake failure because the other end did not send its certificate.

You would get a similar error when you connect to some non-SSL enabled service.

What do you get when you add the -debug option to openssl?


read from 0x9cd8b98 [0x9cde140] (7 bytes => 0 (0x0))

So it read nothing from the socket (suggesting it was closed by the other end or something in between before sending anything)

Is there some sort of proxy on your network? Some sort of iptables redirection or antivirus on the local machine?

What does tshark -Vi any port 993 give you when you try the openssl command?

share|improve this answer
Thanks! Here's the result of running OpenSSL with the -debug option. Apparently I am able to connect from another server on the same network. I am now thinking that this could be distro specific. I've updated my question as well. – tirmm Sep 11 '12 at 6:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.