# Transparent mode proxying imaps traffic - certificate error?

**URL:** <https://discourse.mitmproxy.org/t/transparent-mode-proxying-imaps-traffic-certificate-error/140>\
**Category:** Uncategorized\
**Created:** [August 16, 2016, 4:22pm UTC](https://discourse.mitmproxy.org/t/transparent-mode-proxying-imaps-traffic-certificate-error/140 "2016-08-16T16:22:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eldarik](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Eldarik](https://discourse.mitmproxy.org/u/Eldarik)\
**Post date:** [August 16, 2016, 4:22pm UTC](https://discourse.mitmproxy.org/t/transparent-mode-proxying-imaps-traffic-certificate-error/140/1 "2016-08-16T16:22:31Z")

</div>

Hi,

I want to run mitmproxy as generic ssl proxy to proxy secure imap.  
I’m running mitmproxy in transparent mode and running thunderbird as imap client.  
I have installed the mitmproxy root cert, but i still get following error:  
192.168.78.100:40970: Client Handshake failed. The client may not trust the proxy’s certificate for

If i delete the mitmproxy root cert from the thunderbird cert-store, i get a certificate warning with the generated mitm-certificate, so ssl-interception seems to work.  
Any idea how to solve this issue?

Running mitmproxy 0.17 on ubuntu 16.04.  
Tried:  
mitmdump -T -w out.txt --tcp   
and  
mitmdump -T -ddd -w out.txt --raw-tcp

Thanks,  
Clemens

---

<div class="post-metadata">

**Author:** ![Eldarik](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Eldarik](https://discourse.mitmproxy.org/u/Eldarik)\
**Post date:** [August 18, 2016, 4:07pm UTC](https://discourse.mitmproxy.org/t/transparent-mode-proxying-imaps-traffic-certificate-error/140/2 "2016-08-18T16:07:18Z")

</div>

Another try using mitmdump.  
\> root@ubuntu:~# mitmdump -T -v --port 8080 --tcp IP\_ADDR:993  
\> 192.168.78.100:57364: clientconnect  
\> 192.168.78.100:57364: serverconnect  
\> -\> IP\_ADDR:993  
\> 192.168.78.100:57364: Establish TLS with server  
\> 192.168.78.100:57364: TLS verification failed for upstream server at depth 0 with error: 20  
\> 192.168.78.100:57364: Ignoring server verification error, continuing with connection  
\> 192.168.78.100:57364: ALPN selected by server:  
\> 192.168.78.100:57364: Establish TLS with client  
\> 192.168.78.100:57364: serverdisconnect  
\> -\> 83.136.86.18:993  
\> 192.168.78.100:57364: Client Handshake failed. The client may not trust the proxy’s certificate for mail.rechnerservice.at.  
\> 192.168.78.100:57364: ClientHandshakeException(“Cannot establish TLS with client (sni: host.domain.at): TlsException(’’,)”,)  
\> 192.168.78.100:57364: clientdisconnect

Even if i use the original certificate and key passed with the option --cert, the same error occurs.  
Should it generally be possible to intercept generic SSL traffic (e.g. IMAP)?  
Am i doing something completely wrong?  
Here’s a wireshark capture of the TLS handshake…just an overview, but perhaps someone can point me in the right direction?

 ![](https://canada1.discourse-cdn.com/flex030/uploads/mitmproxy1/original/1X/b92f36b3693254643d791771194dd6180228f32b.png)