diff -Naur fetchmail-6.1.2.orig/fetchmail.c fetchmail-6.1.2/fetchmail.c
--- fetchmail-6.1.2.orig/fetchmail.c	Thu Oct 31 17:45:41 2002
+++ fetchmail-6.1.2/fetchmail.c	Wed Nov 27 18:04:33 2002
@@ -1356,7 +1356,9 @@
 	break;
     case P_IMAP:
 #ifdef IMAP_ENABLE
-	st = doIMAP(ctl);
+	do {
+	    st = doIMAP(ctl);
+	} while (st == PS_REPOLL);
 #else
 	report(stderr, GT_("IMAP support is not configured.\n"));
 	st = PS_PROTOCOL;
@@ -1537,6 +1539,8 @@
 #ifdef	SSL_ENABLE
 	if (ctl->use_ssl)
 	    printf(GT_("  SSL encrypted sessions enabled.\n"));
+	if (ctl->sslproto)
+	    printf(GT_("  SSL protocol: %s.\n"), ctl->sslproto);
 	if (ctl->sslcertck) {
 	    printf(GT_("  SSL server certificate checking enabled.\n"));
 	    if (ctl->sslcertpath != NULL)
diff -Naur fetchmail-6.1.2.orig/imap.c fetchmail-6.1.2/imap.c
--- fetchmail-6.1.2.orig/imap.c	Wed Nov 27 17:58:47 2002
+++ fetchmail-6.1.2/imap.c	Wed Nov 27 18:05:47 2002
@@ -252,6 +252,9 @@
 /* apply for connection authorization */
 {
     int ok = 0;
+#ifdef SSL_ENABLE
+    flag did_stls = FALSE;
+#endif /* SSL_ENABLE */
 
     /* probe to see if we're running IMAP4 and can use RFC822.PEEK */
     capabilities[0] = '\0';
@@ -359,7 +362,7 @@
 #endif /* KERBEROS_V4 */
 
 #ifdef SSL_ENABLE
-    if ((ctl->server.authenticate == A_ANY)
+    if ((!ctl->sslproto || !strcmp(ctl->sslproto,"tls1"))
         && !ctl->use_ssl
         && strstr(capabilities, "STARTTLS"))
     {
@@ -373,10 +376,17 @@
             */
            if (SSLOpen(sock,ctl->sslcert,ctl->sslkey,"tls1",ctl->sslcertck, ctl->sslcertpath,ctl->sslfingerprint,realhost,ctl->server.pollname) == -1)
            {
+	       if (!ctl->sslproto && !ctl->wehaveauthed)
+	       {
+		   ctl->sslproto = xstrdup("");
+		   /* repoll immediately */
+		   return(PS_REPOLL);
+	       }
                report(stderr,
                       GT_("SSL connection failed.\n"));
                return(PS_AUTHFAIL);
            }
+	   did_stls = TRUE;
     }
 #endif /* SSL_ENABLE */
 
@@ -471,6 +481,16 @@
 	strcpy(shroud, password);
 	ok = gen_transact(sock, "LOGIN \"%s\" \"%s\"", remotename, password);
 	shroud[0] = '\0';
+#ifdef SSL_ENABLE
+	/* this is for servers which claim to support TLS, but actually
+	 * don't! */
+	if (did_stls && ok == PS_SOCKET && !ctl->sslproto && !ctl->wehaveauthed)
+	{
+	    ctl->sslproto = xstrdup("");
+	    /* repoll immediately */
+	    ok = PS_REPOLL;
+	}
+#endif
 	if (ok)
 	{
 	    /* SASL cancellation of authentication */
diff -Naur fetchmail-6.1.2.orig/pop3.c fetchmail-6.1.2/pop3.c
--- fetchmail-6.1.2.orig/pop3.c	Thu Oct 31 18:11:37 2002
+++ fetchmail-6.1.2/pop3.c	Wed Nov 27 18:03:40 2002
@@ -145,6 +145,7 @@
 #endif /* OPIE_ENABLE */
 #ifdef SSL_ENABLE
     flag has_ssl = FALSE;
+    flag did_stls = FALSE;
 #endif /* SSL_ENABLE */
 
 #ifdef SDPS_ENABLE
@@ -249,18 +250,29 @@
 #ifdef SSL_ENABLE
 	if (has_ssl
 	    && !ctl->use_ssl
-	    && (ctl->server.authenticate == A_ANY))
+	    && (!ctl->sslproto || !strcmp(ctl->sslproto,"tls1")))
 	{
 	    char *realhost;
 
 	   realhost = ctl->server.via ? ctl->server.via : ctl->server.pollname;
            gen_transact(sock, "STLS");
-	   if (SSLOpen(sock,ctl->sslcert,ctl->sslkey,ctl->sslproto,ctl->sslcertck, ctl->sslcertpath,ctl->sslfingerprint,realhost,ctl->server.pollname) == -1)
+
+           /* We use "tls1" instead of ctl->sslproto, as we want STLS,
+            * not other SSL protocols
+            */
+	   if (SSLOpen(sock,ctl->sslcert,ctl->sslkey,"tls1",ctl->sslcertck, ctl->sslcertpath,ctl->sslfingerprint,realhost,ctl->server.pollname) == -1)
 	   {
+	       if (!ctl->sslproto && !ctl->wehaveauthed)
+	       {
+		   ctl->sslproto = xstrdup("");
+		   /* repoll immediately */
+		   return(PS_REPOLL);
+	       }
 	       report(stderr,
 		       GT_("SSL connection failed.\n"));
 		return(PS_AUTHFAIL);
 	    }
+	   did_stls = TRUE;
 	}
 #endif /* SSL_ENABLE */
 
@@ -350,6 +362,16 @@
 	strcpy(shroud, ctl->password);
 	ok = gen_transact(sock, "PASS %s", ctl->password);
 	shroud[0] = '\0';
+#ifdef SSL_ENABLE
+	/* this is for servers which claim to support TLS, but actually
+	 * don't! */
+	if (did_stls && ok == PS_SOCKET && !ctl->sslproto && !ctl->wehaveauthed)
+	{
+	    ctl->sslproto = xstrdup("");
+	    /* repoll immediately */
+	    ok = PS_REPOLL;
+	}
+#endif
 	break;
 
     case P_APOP:
diff -Naur fetchmail-6.1.2.orig/socket.c fetchmail-6.1.2/socket.c
--- fetchmail-6.1.2.orig/socket.c	Sun Jun 23 01:34:49 2002
+++ fetchmail-6.1.2/socket.c	Wed Nov 27 18:00:39 2002
@@ -876,6 +876,8 @@
 				_ctx = SSL_CTX_new(SSLv3_client_method());
 			} else if(!strcmp("tls1",myproto)) {
 				_ctx = SSL_CTX_new(TLSv1_client_method());
+			} else if (!strcmp("ssl23",myproto)) {
+				myproto = NULL;
 			} else {
 				fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto);
 				myproto = NULL;