I am using K-9 Mail on Android and have set the SSL option to 'SSL (strict)'.

My understanding is that with this option K-9 definitely requires a valid SSL certificate which is issued by a trusted CA, i.e. no self-signed certificates.

What I am wondering about is whether K-9 actually evaluates the CN field in the certificate, i.e. whether it only accepts a certificate as valid and trusted if the CN and the mail server's DNS name match. This is IMO a fundamental requirement in order to not fall for MITM attacks. If K-9 did not match those, in the worst case K-9 would accept any (wildcard) certificate presented on the condition that is has been signed by a trusted CA.

Has anyone tested/confirmed/verified that this is not the case?

1 Answer 1


It uses the Android in-built SSL socket factory to create the connection. So yes, it's just as authenticated as accessing a secure webpage on the phone's browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .