kmail: Rename SSL to TLS and TLS to STARTTLSrename/kmail-ssl-tls-starttls

This makes it clearer in both code and UI what should be configured for
the client.

Signed-off-by: mio <[email protected]>

22 files changed, 254 insertions, 185 deletions

diff --git a/kmail/accountdialog.cpp b/kmail/accountdialog.cpp
index c8ac7e29d..6aa0b6a8c 100644
--- a/kmail/accountdialog.cpp
+++ b/kmail/accountdialog.cpp
@@ -274,8 +274,8 @@ AccountDialog::AccountDialog( const TQString & caption, KMAccount *account,
     mServerTest( 0 ),
     mCurCapa( AllCapa ),
     mCapaNormal( AllCapa ),
-    mCapaSSL( AllCapa ),
     mCapaTLS( AllCapa ),
+    mCapaSTARTTLS( AllCapa ),
     mSieveConfigEditor( 0 )
 {
   mValidator = new TQRegExpValidator( TQRegExp( "[A-Za-z0-9-_:.]*" ), 0 );
@@ -778,16 +778,18 @@ void AccountDialog::makePopAccountPage()
 
   vlay->addSpacing( KDialog::spacingHint() );
 
+  // TODO(mio): RFC 8134 - Use TLS by default.
   mPop.encryptionGroup = new TQButtonGroup( 1, TQt::Horizontal,
     i18n("Encryption"), page2 );
   mPop.encryptionNone =
     new TQRadioButton( i18n("&None"), mPop.encryptionGroup );
-  mPop.encryptionSSL =
-    new TQRadioButton( i18n("Use &SSL for secure mail download"),
+  mPop.encryptionSTARTTLS =
+    new TQRadioButton( i18n("Use &STARTTLS for secure mail download"),
     mPop.encryptionGroup );
   mPop.encryptionTLS =
-    new TQRadioButton( i18n("Use &TLS for secure mail download"),
+    new TQRadioButton( i18n("Use SSL/&TLS for secure mail download"),
     mPop.encryptionGroup );
+
   connect(mPop.encryptionGroup, TQ_SIGNAL(clicked(int)),
     TQ_SLOT(slotPopEncryptionChanged(int)));
   vlay->addWidget( mPop.encryptionGroup );
@@ -1093,15 +1095,16 @@ void AccountDialog::makeImapAccountPage( bool connected )
 
   vlay->addSpacing( KDialog::spacingHint() );
 
+  // TODO(mio): RFC 8134 - Use TLS by default.
   mImap.encryptionGroup = new TQButtonGroup( 1, TQt::Horizontal,
     i18n("Encryption"), page2 );
   mImap.encryptionNone =
     new TQRadioButton( i18n("&None"), mImap.encryptionGroup );
-  mImap.encryptionSSL =
-    new TQRadioButton( i18n("Use &SSL for secure mail download"),
+  mImap.encryptionSTARTTLS =
+    new TQRadioButton( i18n("Use &STARTTLS for secure mail download"),
     mImap.encryptionGroup );
   mImap.encryptionTLS =
-    new TQRadioButton( i18n("Use &TLS for secure mail download"),
+    new TQRadioButton( i18n("Use SSL/&TLS for secure mail download"),
     mImap.encryptionGroup );
   connect(mImap.encryptionGroup, TQ_SIGNAL(clicked(int)),
     TQ_SLOT(slotImapEncryptionChanged(int)));
@@ -1218,10 +1221,10 @@ void AccountDialog::setupSettings()
     mPop.includeInCheck->setChecked( !mAccount->checkExclude() );
     mPop.precommand->setText( ap.precommand() );
     mPop.identityCombo-> setCurrentIdentity( mAccount->identityId() );
-    if (ap.useSSL())
-      mPop.encryptionSSL->setChecked( true );
-    else if (ap.useTLS())
+    if (ap.useTLS())
       mPop.encryptionTLS->setChecked( true );
+    else if (ap.useSTARTTLS())
+      mPop.encryptionSTARTTLS->setChecked( true );
     else mPop.encryptionNone->setChecked( true );
     if (ap.auth() == "LOGIN")
       mPop.authLogin->setChecked( true );
@@ -1278,10 +1281,10 @@ void AccountDialog::setupSettings()
     slotEnableImapInterval( interval >= 1 );
     mImap.identityCombo-> setCurrentIdentity( mAccount->identityId() );
     //mImap.identityCombo->insertStringList( kmkernel->identityManager()->shadowIdentities() );
-    if (ai.useSSL())
-      mImap.encryptionSSL->setChecked( true );
-    else if (ai.useTLS())
+    if (ai.useTLS())
       mImap.encryptionTLS->setChecked( true );
+    else if (ai.useSTARTTLS())
+      mImap.encryptionSTARTTLS->setChecked( true );
     else mImap.encryptionNone->setChecked( true );
     if (ai.auth() == "CRAM-MD5")
       mImap.authCramMd5->setChecked( true );
@@ -1328,10 +1331,10 @@ void AccountDialog::setupSettings()
     slotEnableImapInterval( interval >= 1 );
     mImap.identityCombo-> setCurrentIdentity( mAccount->identityId() );
     //mImap.identityCombo->insertStringList( kmkernel->identityManager()->shadowIdentities() );
-    if (ai.useSSL())
-      mImap.encryptionSSL->setChecked( true );
-    else if (ai.useTLS())
+    if (ai.useTLS())
       mImap.encryptionTLS->setChecked( true );
+    else if (ai.useSTARTTLS())
+      mImap.encryptionSTARTTLS->setChecked( true );
     else mImap.encryptionNone->setChecked( true );
     if (ai.auth() == "CRAM-MD5")
       mImap.authCramMd5->setChecked( true );
@@ -1499,12 +1502,12 @@ void AccountDialog::slotPopEncryptionChanged(int id)
 {
   kdDebug(5006) << "slotPopEncryptionChanged( " << id << " )" << endl;
   // adjust port
-  if ( id == SSL || mPop.portEdit->text() == "995" )
-    mPop.portEdit->setText( ( id == SSL ) ? "995" : "110" );
+  if ( id == TLSEncryption || mPop.portEdit->text() == "995" )
+    mPop.portEdit->setText( ( id == TLSEncryption ) ? "995" : "110" );
 
   // switch supported auth methods
-  mCurCapa = ( id == TLS ) ? mCapaTLS
-                           : ( id == SSL ) ? mCapaSSL
+  mCurCapa = ( id == STARTTLSEncryption ) ? mCapaSTARTTLS
+                           : ( id == TLSEncryption ) ? mCapaTLS
                                            : mCapaNormal;
   enablePopFeatures( mCurCapa );
   const TQButton *old = mPop.authGroup->selected();
@@ -1517,12 +1520,12 @@ void AccountDialog::slotImapEncryptionChanged(int id)
 {
   kdDebug(5006) << "slotImapEncryptionChanged( " << id << " )" << endl;
   // adjust port
-  if ( id == SSL || mImap.portEdit->text() == "993" )
-    mImap.portEdit->setText( ( id == SSL ) ? "993" : "143" );
+  if (id == TLSEncryption || mImap.portEdit->text() == "933")
+    mImap.portEdit->setText((id == TLSEncryption) ? "993" : "143");
 
   // switch supported auth methods
-  int authMethods = ( id == TLS ) ? mCapaTLS
-                                  : ( id == SSL ) ? mCapaSSL
+  int authMethods = ( id == STARTTLSEncryption ) ? mCapaSTARTTLS
+                                  : ( id == TLSEncryption ) ? mCapaTLS
                                                   : mCapaNormal;
   enableImapAuthMethods( authMethods );
   TQButton *old = mImap.authGroup->selected();
@@ -1603,21 +1606,21 @@ unsigned int AccountDialog::popCapabilitiesFromStringList( const TQStringList &
 
 
 void AccountDialog::slotPopCapabilities( const TQStringList & capaNormal,
-                                         const TQStringList & capaSSL )
+                                         const TQStringList & capaTLS )
 {
   mPop.checkCapabilities->setEnabled( true );
   mCapaNormal = popCapabilitiesFromStringList( capaNormal );
   if ( mCapaNormal & STLS )
-    mCapaTLS = mCapaNormal;
+    mCapaSTARTTLS = mCapaNormal;
   else
-    mCapaTLS = 0;
-  mCapaSSL = popCapabilitiesFromStringList( capaSSL );
+    mCapaSTARTTLS = 0;
+  mCapaTLS = popCapabilitiesFromStringList( capaTLS );
   kdDebug(5006) << "mCapaNormal = " << mCapaNormal
-                << "; mCapaSSL = " << mCapaSSL
-                << "; mCapaTLS = " << mCapaTLS << endl;
+                << "; mCapaTLS = " << mCapaTLS
+                << "; mCapaSTARTTLS = " << mCapaSTARTTLS << endl;
   mPop.encryptionNone->setEnabled( !capaNormal.isEmpty() );
-  mPop.encryptionSSL->setEnabled( !capaSSL.isEmpty() );
-  mPop.encryptionTLS->setEnabled( mCapaTLS != 0 );
+  mPop.encryptionTLS->setEnabled( !capaTLS.isEmpty() );
+  mPop.encryptionSTARTTLS->setEnabled( mCapaSTARTTLS != 0 );
   checkHighest( mPop.encryptionGroup );
   delete mServerTest;
   mServerTest = 0;
@@ -1709,21 +1712,21 @@ unsigned int AccountDialog::imapCapabilitiesFromStringList( const TQStringList &
 
 
 void AccountDialog::slotImapCapabilities( const TQStringList & capaNormal,
-                                          const TQStringList & capaSSL )
+                                          const TQStringList & capaTLS )
 {
   mImap.checkCapabilities->setEnabled( true );
   mCapaNormal = imapCapabilitiesFromStringList( capaNormal );
   if ( mCapaNormal & STARTTLS )
-    mCapaTLS = mCapaNormal;
+    mCapaSTARTTLS = mCapaNormal;
   else
-    mCapaTLS = 0;
-  mCapaSSL = imapCapabilitiesFromStringList( capaSSL );
+    mCapaSTARTTLS = 0;
+  mCapaTLS = imapCapabilitiesFromStringList( capaTLS );
   kdDebug(5006) << "mCapaNormal = " << mCapaNormal
-                << "; mCapaSSL = " << mCapaSSL
-                << "; mCapaTLS = " << mCapaTLS << endl;
+                << "; mCapaTLS = " << mCapaTLS
+                << "; mCapaSTARTTLS = " << mCapaSTARTTLS << endl;
   mImap.encryptionNone->setEnabled( !capaNormal.isEmpty() );
-  mImap.encryptionSSL->setEnabled( !capaSSL.isEmpty() );
-  mImap.encryptionTLS->setEnabled( mCapaTLS != 0 );
+  mImap.encryptionTLS->setEnabled( !capaTLS.isEmpty() );
+  mImap.encryptionSTARTTLS->setEnabled( mCapaSTARTTLS != 0 );
   checkHighest( mImap.encryptionGroup );
   delete mServerTest;
   mServerTest = 0;
@@ -2197,8 +2200,8 @@ void AccountDialog::initAccountForConnect()
     na.setLogin( mPop.loginEdit->text().stripWhiteSpace() );
     na.setStorePasswd( mPop.storePasswordCheck->isChecked() );
     na.setPasswd( mPop.passwordEdit->text(), na.storePasswd() );
-    na.setUseSSL( mPop.encryptionSSL->isChecked() );
     na.setUseTLS( mPop.encryptionTLS->isChecked() );
+    na.setUseSTARTTLS( mPop.encryptionSTARTTLS->isChecked() );
     if (mPop.authUser->isChecked())
       na.setAuth("USER");
     else if (mPop.authLogin->isChecked())
@@ -2223,8 +2226,8 @@ void AccountDialog::initAccountForConnect()
     na.setLogin( mImap.loginEdit->text().stripWhiteSpace() );
     na.setStorePasswd( mImap.storePasswordCheck->isChecked() );
     na.setPasswd( mImap.passwordEdit->text(), na.storePasswd() );
-    na.setUseSSL( mImap.encryptionSSL->isChecked() );
     na.setUseTLS( mImap.encryptionTLS->isChecked() );
+    na.setUseSTARTTLS( mImap.encryptionSTARTTLS->isChecked() );
     if (mImap.authCramMd5->isChecked())
       na.setAuth("CRAM-MD5");
     else if (mImap.authDigestMd5->isChecked())
diff --git a/kmail/accountdialog.h b/kmail/accountdialog.h
index 417d0e281..76b1cd9ce 100644
--- a/kmail/accountdialog.h
+++ b/kmail/accountdialog.h
@@ -121,7 +121,7 @@ class AccountDialog : public KDialogBase
       TQLineEdit    *precommand;
       TQButtonGroup *encryptionGroup;
       TQRadioButton *encryptionNone;
-      TQRadioButton *encryptionSSL;
+      TQRadioButton *encryptionSTARTTLS;
       TQRadioButton *encryptionTLS;
       TQButtonGroup *authGroup;
       TQRadioButton *authUser;
@@ -187,7 +187,7 @@ class AccountDialog : public KDialogBase
       KIntNumInput *intervalSpin;
       TQButtonGroup *encryptionGroup;
       TQRadioButton *encryptionNone;
-      TQRadioButton *encryptionSSL;
+      TQRadioButton *encryptionSTARTTLS;
       TQRadioButton *encryptionTLS;
       TQButtonGroup *authGroup;
       TQRadioButton *authUser;
@@ -273,8 +273,8 @@ class AccountDialog : public KDialogBase
     KMServerTest *mServerTest;
     enum EncryptionMethods {
       NoEncryption = 0,
-      SSL = 1,
-      TLS = 2
+      STARTTLSEncryption = 1, // STARTTLS/STLS for IMAP/POP
+      TLSEncryption = 2       // Implicit TLS for all
     };
     enum Capabilities {
       Plain      =   1,
@@ -294,8 +294,8 @@ class AccountDialog : public KDialogBase
     };
     unsigned int mCurCapa;
     unsigned int mCapaNormal;
-    unsigned int mCapaSSL;
     unsigned int mCapaTLS;
+    unsigned int mCapaSTARTTLS;
     KMail::SieveConfigEditor *mSieveConfigEditor;
     TQRegExpValidator *mValidator;
 };
diff --git a/kmail/accountwizard.cpp b/kmail/accountwizard.cpp
index b050275c7..f94dd0036 100644
--- a/kmail/accountwizard.cpp
+++ b/kmail/accountwizard.cpp
@@ -276,7 +276,8 @@ void AccountWizard::setupServerInformationPage()
 
   mIncomingServerWdg = new TQVBox( mServerInformationPage );
   mIncomingServer = new KLineEdit( mIncomingServerWdg );
-  mIncomingUseSSL = new TQCheckBox( i18n( "Use secure connection (SSL)" ), mIncomingServerWdg );
+  mIncomingUseTLS = new TQCheckBox( i18n( "Use secure connection (SSL/TLS)" ), mIncomingServerWdg );
+  mIncomingUseTLS->setChecked(true);
 
   mIncomingLocationWdg = new TQHBox( mServerInformationPage );
   mIncomingLocation = new KLineEdit( mIncomingLocationWdg );
@@ -296,8 +297,9 @@ void AccountWizard::setupServerInformationPage()
   layout->addWidget( label, 1, 0 );
   layout->addWidget( mOutgoingServer, 1, 1 );
 
-  mOutgoingUseSSL = new TQCheckBox( i18n( "Use secure connection (SSL)" ), mServerInformationPage );
-  layout->addWidget( mOutgoingUseSSL, 2, 1 );
+  mOutgoingUseTLS = new TQCheckBox( i18n( "Use secure connection (SSL/TLS)" ), mServerInformationPage );
+  mOutgoingUseTLS->setChecked(true);
+  layout->addWidget( mOutgoingUseTLS, 2, 1 );
 
   mLocalDelivery = new TQCheckBox( i18n( "Use local delivery" ),
                                   mServerInformationPage );
@@ -394,7 +396,7 @@ void AccountWizard::createTransport()
     mTransportInfo->user = mLoginName->text();
     mTransportInfo->setPasswd( mPassword->text() );
 
-    int port = (mOutgoingUseSSL->isChecked() ? 465 : 25);
+    int port = (mOutgoingUseTLS->isChecked() ? 465 : 25);
     checkSmtpCapabilities( mTransportInfo->host, port );
   }
 }
@@ -449,7 +451,7 @@ void AccountWizard::createAccount()
       acct->setLogin( mLoginName->text() );
       acct->setPasswd( mPassword->text() );
       acct->setHost( mIncomingServer->text() );
-      port = mIncomingUseSSL->isChecked() ? 995 : 110;
+      port = mIncomingUseTLS->isChecked() ? 995 : 110;
       break;
     }
     case AccountTypeBox::IMAP:
@@ -459,7 +461,7 @@ void AccountWizard::createAccount()
       acct->setLogin( mLoginName->text() );
       acct->setPasswd( mPassword->text() );
       acct->setHost( mIncomingServer->text() );
-      port = mIncomingUseSSL->isChecked() ? 993 : 143;
+      port = mIncomingUseTLS->isChecked() ? 993 : 143;
       break;
     }
     case AccountTypeBox::dIMAP:
@@ -469,7 +471,7 @@ void AccountWizard::createAccount()
       acct->setLogin( mLoginName->text() );
       acct->setPasswd( mPassword->text() );
       acct->setHost( mIncomingServer->text() );
-      port = mIncomingUseSSL->isChecked() ? 993 : 143;
+      port = mIncomingUseTLS->isChecked() ? 993 : 143;
       break;
     }
     case AccountTypeBox::Maildir:
@@ -516,7 +518,7 @@ void AccountWizard::checkPopCapabilities( const TQString &server, int port )
   connect( mServerTest, TQ_SIGNAL( capabilities( const TQStringList&, const TQStringList& ) ),
            this, TQ_SLOT( popCapabilities( const TQStringList&, const TQStringList& ) ) );
 
-  mAuthInfoLabel = createInfoLabel( i18n( "Check for supported security capabilities of %1..." ).arg( server ) );
+  mAuthInfoLabel = createInfoLabel( i18n( "Checking for supported security capabilities of %1..." ).arg( server ) );
 }
 
 void AccountWizard::checkImapCapabilities( const TQString &server, int port )
@@ -527,7 +529,7 @@ void AccountWizard::checkImapCapabilities( const TQString &server, int port )
   connect( mServerTest, TQ_SIGNAL( capabilities( const TQStringList&, const TQStringList& ) ),
            this, TQ_SLOT( imapCapabilities( const TQStringList&, const TQStringList& ) ) );
 
-  mAuthInfoLabel = createInfoLabel( i18n( "Check for supported security capabilities of %1..." ).arg( server ) );
+  mAuthInfoLabel = createInfoLabel( i18n( "Checking for supported security capabilities of %1..." ).arg( server ) );
 }
 
 void AccountWizard::checkSmtpCapabilities( const TQString &server, int port )
@@ -540,29 +542,29 @@ void AccountWizard::checkSmtpCapabilities( const TQString &server, int port )
            this, TQ_SLOT( smtpCapabilities( const TQStringList&, const TQStringList&,
                                          const TQString&, const TQString&, const TQString& ) ) );
 
-  mAuthInfoLabel = createInfoLabel( i18n( "Check for supported security capabilities of %1..." ).arg( server ) );
+  mAuthInfoLabel = createInfoLabel( i18n( "Checking for supported security capabilities of %1..." ).arg( server ) );
 }
 
 void AccountWizard::popCapabilities( const TQStringList &capaNormalList,
-                                     const TQStringList &capaSSLList )
+                                     const TQStringList &capaTLSList )
 {
   uint capaNormal = popCapabilitiesFromStringList( capaNormalList );
-  uint capaTLS = 0;
+  uint capaSTARTTLS = 0;
 
   if ( capaNormal & STLS )
-    capaTLS = capaNormal;
+    capaSTARTTLS = capaNormal;
 
-  uint capaSSL = popCapabilitiesFromStringList( capaSSLList );
+  uint capaTLS = popCapabilitiesFromStringList( capaTLSList );
 
   KMail::NetworkAccount *account = static_cast<KMail::NetworkAccount*>( mAccount );
 
-  bool useSSL = !capaSSLList.isEmpty();
-  bool useTLS = capaTLS != 0;
+  bool useTLS = !capaTLSList.isEmpty();
+  bool useSTARTTLS = capaSTARTTLS != 0;
 
-  account->setUseSSL( useSSL );
+  account->setUseSTARTTLS( useSTARTTLS );
   account->setUseTLS( useTLS );
 
-  uint capa = (useSSL ? capaSSL : (useTLS ? capaTLS : capaNormal));
+  uint capa = (useTLS ? capaTLS : (useSTARTTLS ? capaSTARTTLS : capaNormal));
 
   if ( capa & Plain )
     account->setAuth( "PLAIN" );
@@ -581,7 +583,7 @@ void AccountWizard::popCapabilities( const TQStringList &capaNormalList,
   else
     account->setAuth( "USER" );
 
-  account->setPort( useSSL ? 995 : 110 );
+  account->setPort( useTLS ? 995 : 110 );
 
   mServerTest->deleteLater();
   mServerTest = 0;
@@ -594,24 +596,24 @@ void AccountWizard::popCapabilities( const TQStringList &capaNormalList,
 
 
 void AccountWizard::imapCapabilities( const TQStringList &capaNormalList,
-                                      const TQStringList &capaSSLList )
+                                      const TQStringList &capaTLSList )
 {
   uint capaNormal = imapCapabilitiesFromStringList( capaNormalList );
-  uint capaTLS = 0;
+  uint capaSTARTTLS = 0;
   if ( capaNormal & STARTTLS )
-    capaTLS = capaNormal;
+    capaSTARTTLS = capaNormal;
 
-  uint capaSSL = imapCapabilitiesFromStringList( capaSSLList );
+  uint capaTLS = imapCapabilitiesFromStringList( capaTLSList );
 
   KMail::NetworkAccount *account = static_cast<KMail::NetworkAccount*>( mAccount );
 
-  bool useSSL = !capaSSLList.isEmpty();
-  bool useTLS = (capaTLS != 0);
+  bool useTLS = !capaTLSList.isEmpty();
+  bool useSTARTTLS = (capaSTARTTLS != 0);
 
-  account->setUseSSL( useSSL );
+  account->setUseSTARTTLS( useSTARTTLS );
   account->setUseTLS( useTLS );
 
-  uint capa = (useSSL ? capaSSL : (useTLS ? capaTLS : capaNormal));
+  uint capa = (useTLS ? capaTLS : (useSTARTTLS ? capaSTARTTLS : capaNormal));
 
   if ( capa & CRAM_MD5 )
     account->setAuth( "CRAM-MD5" );
@@ -630,7 +632,7 @@ void AccountWizard::imapCapabilities( const TQStringList &capaNormalList,
   else
     account->setAuth( "*" );
 
-  account->setPort( useSSL ? 993 : 143 );
+  account->setPort( useTLS ? 993 : 143 );
 
   mServerTest->deleteLater();
   mServerTest = 0;
@@ -642,36 +644,36 @@ void AccountWizard::imapCapabilities( const TQStringList &capaNormalList,
 }
 
 void AccountWizard::smtpCapabilities( const TQStringList &capaNormal,
-                                      const TQStringList &capaSSL,
+                                      const TQStringList &capaTLS,
                                       const TQString &authNone,
-                                      const TQString &authSSL,
-                                      const TQString &authTLS )
+                                      const TQString &authTLS,
+                                      const TQString &authSTARTTLS )
 {
-  uint authBitsNone, authBitsSSL, authBitsTLS;
+  uint authBitsNone, authBitsTLS, authBitsSTARTTLS;
 
-  if ( authNone.isEmpty() && authSSL.isEmpty() && authTLS.isEmpty() ) {
+  if ( authNone.isEmpty() && authTLS.isEmpty() && authSTARTTLS.isEmpty() ) {
     // slave doesn't seem to support "* AUTH METHODS" metadata (or server can't do AUTH)
     authBitsNone = authMethodsFromStringList( capaNormal );
     if ( capaNormal.findIndex( "STARTTLS" ) != -1 )
-      authBitsTLS = authBitsNone;
+      authBitsSTARTTLS = authBitsNone;
     else
-      authBitsTLS = 0;
-    authBitsSSL = authMethodsFromStringList( capaSSL );
+      authBitsSTARTTLS = 0;
+    authBitsTLS = authMethodsFromStringList( capaTLS );
   } else {
     authBitsNone = authMethodsFromString( authNone );
-    authBitsSSL = authMethodsFromString( authSSL );
     authBitsTLS = authMethodsFromString( authTLS );
+    authBitsSTARTTLS = authMethodsFromString( authSTARTTLS );
   }
 
   uint authBits = 0;
   if ( capaNormal.findIndex( "STARTTLS" ) != -1 ) {
-    mTransportInfo->encryption = "TLS";
+    mTransportInfo->encryption = KMTransportInfo::STARTTLSEncryption;
+    authBits = authBitsSTARTTLS;
+  } else if ( !capaTLS.isEmpty() ) {
+    mTransportInfo->encryption = KMTransportInfo::TLSEncryption;
     authBits = authBitsTLS;
-  } else if ( !capaSSL.isEmpty() ) {
-    mTransportInfo->encryption = "SSL";
-    authBits = authBitsSSL;
   } else {
-    mTransportInfo->encryption = "NONE";
+    mTransportInfo->encryption = KMTransportInfo::NoEncryption;
     authBits = authBitsNone;
   }
 
@@ -688,7 +690,7 @@ void AccountWizard::smtpCapabilities( const TQStringList &capaNormal,
   else
     mTransportInfo->authType = "PLAIN";
 
-  mTransportInfo->port = ( !capaSSL.isEmpty() ? "465" : "25" );
+  mTransportInfo->port = ( !capaTLS.isEmpty() ? "465" : "25" );
 
   mServerTest->deleteLater();
   mServerTest = 0;
diff --git a/kmail/accountwizard.h b/kmail/accountwizard.h
index 0b30ca801..bd61ecf2c 100644
--- a/kmail/accountwizard.h
+++ b/kmail/accountwizard.h
@@ -116,12 +116,12 @@ class AccountWizard : public KWizard
     TQWidget *mServerInformationPage;
     TQLabel *mIncomingLabel;
     KLineEdit *mIncomingServer;
-    TQCheckBox *mIncomingUseSSL;
+    TQCheckBox *mIncomingUseTLS;
     KLineEdit *mIncomingLocation;
 
     TQPushButton *mChooseLocation;
     KLineEdit *mOutgoingServer;
-    TQCheckBox *mOutgoingUseSSL;
+    TQCheckBox *mOutgoingUseTLS;
     TQCheckBox *mLocalDelivery;
 
     TQWidget *mIncomingServerWdg;
diff --git a/kmail/imapaccountbase.cpp b/kmail/imapaccountbase.cpp
index 47d169f9b..6a042c46a 100644
--- a/kmail/imapaccountbase.cpp
+++ b/kmail/imapaccountbase.cpp
@@ -150,7 +150,7 @@ namespace KMail {
   }
 
   TQString ImapAccountBase::protocol() const {
-    return useSSL() ? IMAP_SSL_PROTOCOL : IMAP_PROTOCOL;
+    return useTLS() ? IMAP_SSL_PROTOCOL : IMAP_PROTOCOL;
   }
 
   //
@@ -643,7 +643,7 @@ namespace KMail {
     jd.progressItem = ProgressManager::createProgressItem(
         ProgressManager::getUniqueID(),
         i18n("Retrieving Namespaces"),
-        TQString(), true, useSSL() || useTLS() );
+        TQString(), true, useSTARTTLS() || useTLS() );
     jd.progressItem->setTotalItems( 1 );
     connect ( jd.progressItem,
         TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem* ) ),
@@ -1297,7 +1297,7 @@ namespace KMail {
           TQStyleSheet::escape( name() ),
           i18n("retrieving folders"),
           true,
-          useSSL() || useTLS() );
+          useSTARTTLS() || useTLS() );
       connect ( mListDirProgressItem,
                 TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem* ) ),
                 this,
diff --git a/kmail/imapjob.cpp b/kmail/imapjob.cpp
index ecf2b5e78..b66583e7b 100644
--- a/kmail/imapjob.cpp
+++ b/kmail/imapjob.cpp
@@ -153,7 +153,7 @@ void ImapJob::init( JobType jt, TQString sets, KMFolderImap* folder,
           i18n("Uploading message data"),
           TQStyleSheet::escape( curMsg->subject() ),
           true,
-          account->useSSL() || account->useTLS() );
+          account->useSTARTTLS() || account->useTLS() );
       jd.progressItem->setTotalItems( jd.total );
       connect ( jd.progressItem, TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem*)),
           account, TQ_SLOT( slotAbortRequested( KPIM::ProgressItem* ) ) );
@@ -194,7 +194,7 @@ void ImapJob::init( JobType jt, TQString sets, KMFolderImap* folder,
                             .arg( TQStyleSheet::escape( msg_parent->prettyURL() ),
                                   TQStyleSheet::escape( mDestFolder->prettyURL() ) ),
                           true,
-                          account->useSSL() || account->useTLS() );
+                          account->useSTARTTLS() || account->useTLS() );
     jd.progressItem->setTotalItems( jd.total );
     connect ( jd.progressItem, TQ_SIGNAL(progressItemCanceled(KPIM::ProgressItem*)),
               account, TQ_SLOT( slotAbortRequested(KPIM::ProgressItem* ) ) );
@@ -316,7 +316,7 @@ void ImapJob::slotGetNextMessage()
                           i18n("Message with subject: ") +
                           TQStyleSheet::escape( msg->subject() ),
                           true,
-                          account->useSSL() || account->useTLS() );
+                          account->useSTARTTLS() || account->useTLS() );
   connect ( jd.progressItem, TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem*)),
             account, TQ_SLOT( slotAbortRequested( KPIM::ProgressItem* ) ) );
   jd.progressItem->setTotalItems( jd.total );
diff --git a/kmail/kmacctcachedimap.cpp b/kmail/kmacctcachedimap.cpp
index 4d07b1526..e2944d95a 100644
--- a/kmail/kmacctcachedimap.cpp
+++ b/kmail/kmacctcachedimap.cpp
@@ -245,7 +245,7 @@ void KMAcctCachedImap::processNewMail( KMFolderCachedImap* folder,
     TQStyleSheet::escape( folder->label() ), // will be changed immediately in serverSync anyway
     TQString(),
     true, // can be cancelled
-    useSSL() || useTLS() );
+    useSTARTTLS() || useTLS() );
   connect( mMailCheckProgressItem, TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem* ) ),
            this, TQ_SLOT( slotProgressItemCanceled( KPIM::ProgressItem* ) ) );
 
diff --git a/kmail/kmacctimap.cpp b/kmail/kmacctimap.cpp
index 6ee049678..a1a4d3874 100644
--- a/kmail/kmacctimap.cpp
+++ b/kmail/kmacctimap.cpp
@@ -300,7 +300,7 @@ void KMAcctImap::processNewMail(bool interactive)
         i18n("Checking account: %1" ).arg( TQStyleSheet::escape( name() ) ),
         TQString(), // status
         true, // can be canceled
-        useSSL() || useTLS() );
+        useSTARTTLS() || useTLS() );
 
   mMailCheckProgressItem->setTotalItems( mMailCheckFolders.count() );
   connect ( mMailCheckProgressItem,
diff --git a/kmail/kmfolderimap.cpp b/kmail/kmfolderimap.cpp
index ee573c17c..c1e1bb0a7 100644
--- a/kmail/kmfolderimap.cpp
+++ b/kmail/kmfolderimap.cpp
@@ -247,7 +247,7 @@ void KMFolderImap::remove()
                       i18n("Removing folder"),
                       i18n( "URL: %1" ).arg( TQStyleSheet::escape( folder()->prettyURL() ) ),
                       false,
-                      account()->useSSL() || account()->useTLS() );
+                      account()->useSTARTTLS() || account()->useTLS() );
   account()->insertJob(job, jd);
   connect(job, TQ_SIGNAL(result(TDEIO::Job *)),
           this, TQ_SLOT(slotRemoveFolderResult(TDEIO::Job *)));
@@ -490,7 +490,7 @@ int KMFolderImap::addMsg(TQPtrList<KMMessage>& msgList, TQValueList<int>& aIndex
           i18n("Uploading message data"),
           i18n("Destination folder: %1").arg( TQStyleSheet::escape( folder()->prettyURL() ) ),
           true,
-          account()->useSSL() || account()->useTLS() );
+          account()->useSTARTTLS() || account()->useTLS() );
       mAddMessageProgressItem->setTotalItems( msgList.count() );
       connect ( mAddMessageProgressItem, TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem*)),
           account(), TQ_SLOT( slotAbortRequested( KPIM::ProgressItem* ) ) );
@@ -1068,7 +1068,7 @@ void KMFolderImap::checkValidity()
               TQStyleSheet::escape( folder()->prettyURL() ),
               i18n("checking"),
               false,
-              account()->useSSL() || account()->useTLS() );
+              account()->useSTARTTLS() || account()->useTLS() );
   } else {
     mMailCheckProgressItem->setProgress(0);
   }
@@ -2130,7 +2130,7 @@ bool KMFolderImap::processNewMail(bool)
               TQStyleSheet::escape( folder()->prettyURL() ),
               i18n("updating message counts"),
               false,
-              account()->useSSL() || account()->useTLS() );
+              account()->useSTARTTLS() || account()->useTLS() );
 
   TDEIO::SimpleJob *job = TDEIO::stat(url, false);
   TDEIO::Scheduler::assignJobToSlave(account()->slave(), job);
diff --git a/kmail/kmsender.cpp b/kmail/kmsender.cpp
index 5e8e4b415..3a731069e 100644
--- a/kmail/kmsender.cpp
+++ b/kmail/kmsender.cpp
@@ -499,7 +499,7 @@ void KMSender::doSendMsg()
     mSendProc = createSendProcFromString(msgTransport);
     mMethodStr = msgTransport;
 
-    if( mTransportInfo->encryption == "TLS" || mTransportInfo->encryption == "SSL" ) {
+    if( mTransportInfo->encryption == KMTransportInfo::STARTTLSEncryption || mTransportInfo->encryption == KMTransportInfo::TLSEncryption ) {
       mProgressItem->setUsesCrypto( true );
     } else if ( !mCustomTransport.isEmpty() ) {
         int result = KMessageBox::warningContinueCancel( 0,
@@ -801,7 +801,7 @@ KMSendProc* KMSender::createSendProcFromString( const TQString & transport )
     {
       mTransportInfo->type = "smtp";
       mTransportInfo->auth = false;
-      mTransportInfo->encryption = "NONE";
+      mTransportInfo->encryption = KMTransportInfo::NoEncryption;
       TQString serverport = transport.mid(7);
       int colon = serverport.find(':');
       if (colon != -1) {
@@ -816,7 +816,7 @@ KMSendProc* KMSender::createSendProcFromString( const TQString & transport )
     {
       mTransportInfo->type = "smtps";
       mTransportInfo->auth = false;
-      mTransportInfo->encryption = "ssl";
+      mTransportInfo->encryption = KMTransportInfo::TLSEncryption;
       TQString serverport = transport.mid(7);
       int colon = serverport.find(':');
       if (colon != -1) {
@@ -1079,7 +1079,7 @@ bool KMSendSMTP::doSend( const TQString & sender, const TQStringList & to, const
 
   KURL destination;
 
-  destination.setProtocol((ti->encryption == "SSL") ? SMTPS_PROTOCOL : SMTP_PROTOCOL);
+  destination.setProtocol((ti->encryption == KMTransportInfo::TLSEncryption) ? SMTPS_PROTOCOL : SMTP_PROTOCOL);
   destination.setHost(ti->host);
   destination.setPort(ti->port.toUShort());
 
@@ -1123,7 +1123,8 @@ bool KMSendSMTP::doSend( const TQString & sender, const TQStringList & to, const
   if (!mSlave || !mInProcess)
   {
     TDEIO::MetaData slaveConfig;
-    slaveConfig.insert("tls", (ti->encryption == "TLS") ? "on" : "off");
+    // COMPAT: To keep compatibility with the IOSlaves, we use "tls" for STARTTLS.
+    slaveConfig.insert("tls", (ti->encryption == KMTransportInfo::STARTTLSEncryption) ? "on" : "off");
     if (ti->auth) slaveConfig.insert("sasl", ti->authType);
     mSlave = TDEIO::Scheduler::getConnectedSlave(destination, slaveConfig);
   }
diff --git a/kmail/kmtransport.cpp b/kmail/kmtransport.cpp
index 764c17206..6012d756b 100644
--- a/kmail/kmtransport.cpp
+++ b/kmail/kmtransport.cpp
@@ -76,13 +76,28 @@ void KMTransportInfo::readConfig(int id)
   user = config->readEntry("user");
   mPasswd = KMAccount::decryptStr(config->readEntry("pass"));
   precommand = config->readPathEntry("precommand");
-  encryption = config->readEntry("encryption");
   authType = config->readEntry("authtype");
   auth = config->readBoolEntry("auth");
   mStorePasswd = config->readBoolEntry("storepass");
   specifyHostname = config->readBoolEntry("specifyHostname", false);
   localHostname = config->readEntry("localHostname");
 
+  // COMPAT: Previous versions of KMail stored encryption as a string.
+  // TODO(mio): Write upgrade script to convert these to match KMTransportInfo::EncryptionMode.
+  TQString encryptionString = config->readEntry("encryption");
+  if (encryptionString == "TLS") // TLS => STARTTLS
+  {
+    encryption = STARTTLSEncryption;
+  }
+  else if (encryptionString == "SSL") // SSL => SSL/TLS
+  {
+    encryption = TLSEncryption;
+  }
+  else
+  {
+    encryption = NoEncryption;
+  }
+
   if ( !storePasswd() )
     return;
 
@@ -116,13 +131,27 @@ void KMTransportInfo::writeConfig(int id)
   config->writeEntry("port", port);
   config->writeEntry("user", user);
   config->writePathEntry("precommand", precommand);
-  config->writeEntry("encryption", encryption);
   config->writeEntry("authtype", authType);
   config->writeEntry("auth", auth);
   config->writeEntry("storepass", storePasswd());
   config->writeEntry("specifyHostname", specifyHostname);
   config->writeEntry("localHostname", localHostname);
 
+  // COMPAT: Previous versions of KMail stored encryption as a string.
+  // TODO(mio): Write upgrade script and change this to write integer.
+  switch (encryption)
+  {
+    case TLSEncryption:
+      config->writeEntry("encryption", "SSL"); // SSL => SSL/TLS
+      break;
+    case STARTTLSEncryption:
+      config->writeEntry("encryption", "TLS"); // TLS => STARTTLS
+      break;
+    case NoEncryption:
+      config->writeEntry("encryption", "NONE");
+      break;
+  }
+
   if ( storePasswd() ) {
     // write password into the wallet if possible and necessary
     bool passwdStored = false;
@@ -287,7 +316,7 @@ KMTransportDialog::KMTransportDialog( const TQString & caption,
   : KDialogBase( parent, name, modal, caption, Ok|Cancel, Ok, true ),
     mServerTest( 0 ),
     mTransportInfo( transportInfo ),
-    mAuthNone( AllAuth ), mAuthSSL( AllAuth ), mAuthTLS( AllAuth )
+    mAuthNone( AllAuth ), mAuthTLS( AllAuth ), mAuthSTARTTLS( AllAuth )
 {
   assert(transportInfo != 0);
 
@@ -498,14 +527,16 @@ void KMTransportDialog::makeSmtpPage()
   TQWidget *page2 = new TQWidget( tabWidget );
   tabWidget->addTab( page2, i18n("S&ecurity") );
   TQVBoxLayout *vlay = new TQVBoxLayout( page2, spacingHint() );
+
+  // TODO(mio): RFC 8134 - Use TLS by default.
   mSmtp.encryptionGroup = new TQButtonGroup( 1, TQt::Horizontal,
     i18n("Encryption"), page2 );
   mSmtp.encryptionNone =
     new TQRadioButton( i18n("&None"), mSmtp.encryptionGroup );
-  mSmtp.encryptionSSL =
-    new TQRadioButton( i18n("&SSL"), mSmtp.encryptionGroup );
   mSmtp.encryptionTLS =
-    new TQRadioButton( i18n("&TLS"), mSmtp.encryptionGroup );
+    new TQRadioButton( i18n("SSL/&TLS"), mSmtp.encryptionGroup );
+  mSmtp.encryptionSTARTTLS =
+    new TQRadioButton( i18n("&STARTTLS"), mSmtp.encryptionGroup );
   connect(mSmtp.encryptionGroup, TQ_SIGNAL(clicked(int)),
     TQ_SLOT(slotSmtpEncryptionChanged(int)));
   vlay->addWidget( mSmtp.encryptionGroup );
@@ -558,10 +589,10 @@ void KMTransportDialog::setupSettings()
     mSmtp.specifyHostnameCheck->setChecked(mTransportInfo->specifyHostname);
     mSmtp.localHostnameEdit->setText(mTransportInfo->localHostname);
 
-    if (mTransportInfo->encryption == "TLS")
+    if (mTransportInfo->encryption == KMTransportInfo::STARTTLSEncryption)
+      mSmtp.encryptionSTARTTLS->setChecked(true);
+    else if (mTransportInfo->encryption == KMTransportInfo::TLSEncryption)
       mSmtp.encryptionTLS->setChecked(true);
-    else if (mTransportInfo->encryption == "SSL")
-      mSmtp.encryptionSSL->setChecked(true);
     else mSmtp.encryptionNone->setChecked(true);
 
     if (mTransportInfo->authType == "LOGIN")
@@ -601,8 +632,18 @@ void KMTransportDialog::saveSettings()
     mTransportInfo->specifyHostname = mSmtp.specifyHostnameCheck->isChecked();
     mTransportInfo->localHostname = mSmtp.localHostnameEdit->text().stripWhiteSpace();
 
-    mTransportInfo->encryption = (mSmtp.encryptionTLS->isChecked()) ? "TLS" :
-    (mSmtp.encryptionSSL->isChecked()) ? "SSL" : "NONE";
+    if (mSmtp.encryptionSTARTTLS->isChecked())
+    {
+      mTransportInfo->encryption = KMTransportInfo::STARTTLSEncryption;
+    }
+    else if (mSmtp.encryptionTLS->isChecked())
+    {
+      mTransportInfo->encryption = KMTransportInfo::TLSEncryption;
+    }
+    else
+    {
+      mTransportInfo->encryption = KMTransportInfo::NoEncryption;
+    }
 
     mTransportInfo->authType = (mSmtp.authLogin->isChecked()) ? "LOGIN" :
     (mSmtp.authCramMd5->isChecked()) ? "CRAM-MD5" :
@@ -652,13 +693,22 @@ void KMTransportDialog::slotRequiresAuthClicked()
 void KMTransportDialog::slotSmtpEncryptionChanged(int id)
 {
   kdDebug(5006) << "KMTransportDialog::slotSmtpEncryptionChanged( " << id << " )" << endl;
-  // adjust SSL port:
-  if (id == SSL || mSmtp.portEdit->text() == "465")
-    mSmtp.portEdit->setText((id == SSL) ? "465" : "25");
+  switch (id)
+  {
+    case KMTransportInfo::TLSEncryption:
+      mSmtp.portEdit->setText("465"); // RFC8314 - 3.3
+      break;
+    case KMTransportInfo::STARTTLSEncryption:
+      mSmtp.portEdit->setText("587"); // RFC6409 - 3.1 / RFC 8314 - 3.3
+      break;
+    default:
+      mSmtp.portEdit->setText("25");
+      break;
+  }
 
   // switch supported auth methods:
   TQButton * old = mSmtp.authGroup->selected();
-  int authMethods = id == TLS ? mAuthTLS : id == SSL ? mAuthSSL : mAuthNone ;
+  int authMethods = id == KMTransportInfo::STARTTLSEncryption ? mAuthSTARTTLS : id == KMTransportInfo::TLSEncryption ? mAuthTLS : mAuthNone ;
   enableAuthMethods( authMethods );
   if ( !old->isEnabled() )
     checkHighest( mSmtp.authGroup );
@@ -746,34 +796,34 @@ void KMTransportDialog::checkHighest(TQButtonGroup *btnGroup)
 
 
 void KMTransportDialog::slotSmtpCapabilities( const TQStringList & capaNormal,
-                                              const TQStringList & capaSSL,
+                                              const TQStringList & capaTLS,
                                               const TQString & authNone,
-                                              const TQString & authSSL,
-                                              const TQString & authTLS )
+                                              const TQString & authTLS,
+                                              const TQString & authSTARTTLS )
 {
   mSmtp.checkCapabilities->setEnabled( true );
   kdDebug(5006) << "KMTransportDialog::slotSmtpCapabilities( ..., "
-	    << authNone << ", " << authSSL << ", " << authTLS << " )" << endl;
+	    << authNone << ", " << authTLS << ", " << authSTARTTLS << " )" << endl;
   mSmtp.encryptionNone->setEnabled( !capaNormal.isEmpty() );
-  mSmtp.encryptionSSL->setEnabled( !capaSSL.isEmpty() );
-  mSmtp.encryptionTLS->setEnabled( capaNormal.findIndex("STARTTLS") != -1 );
-  if ( authNone.isEmpty() && authSSL.isEmpty() && authTLS.isEmpty() ) {
+  mSmtp.encryptionTLS->setEnabled( !capaTLS.isEmpty() );
+  mSmtp.encryptionSTARTTLS->setEnabled( capaNormal.findIndex("STARTTLS") != -1 );
+  if ( authNone.isEmpty() && authTLS.isEmpty() && authSTARTTLS.isEmpty() ) {
     // slave doesn't seem to support "* AUTH METHODS" metadata (or server can't do AUTH)
     mAuthNone = authMethodsFromStringList( capaNormal );
-    if ( mSmtp.encryptionTLS->isEnabled() )
-      mAuthTLS = mAuthNone;
+    if ( mSmtp.encryptionSTARTTLS->isEnabled() )
+      mAuthSTARTTLS = mAuthNone;
     else
-      mAuthTLS = 0;
-    mAuthSSL = authMethodsFromStringList( capaSSL );
+      mAuthSTARTTLS = 0;
+    mAuthTLS = authMethodsFromStringList( capaTLS );
   }
   else {
     mAuthNone = authMethodsFromString( authNone );
-    mAuthSSL = authMethodsFromString( authSSL );
     mAuthTLS = authMethodsFromString( authTLS );
+    mAuthSTARTTLS = authMethodsFromString( authSTARTTLS );
   }
   kdDebug(5006) << "mAuthNone = " << mAuthNone
-                << "; mAuthSSL = " << mAuthSSL
-                << "; mAuthTLS = " << mAuthTLS << endl;
+                << "; mAuthTLS = " << mAuthTLS
+                << "; mAuthSTARTTLS = " << mAuthSTARTTLS << endl;
   checkHighest( mSmtp.encryptionGroup );
   delete mServerTest;
   mServerTest = 0;
diff --git a/kmail/kmtransport.h b/kmail/kmtransport.h
index 7f0cd41ba..9d1707c17 100644
--- a/kmail/kmtransport.h
+++ b/kmail/kmtransport.h
@@ -32,6 +32,17 @@ class TQButtonGroup;
 class KMTransportInfo : public TQObject
 {
 public:
+
+  enum EncryptionMode
+  {
+    /*! Do not use any encryption. */
+    NoEncryption = 0,
+    /*! Use SSL/TLS encryption. */
+    TLSEncryption = 1,
+    /*! Use STARTTLS to upgrade an initially unencrypted connection. */
+    STARTTLSEncryption = 2
+  };
+
   KMTransportInfo();
   virtual ~KMTransportInfo();
   void readConfig(int id);
@@ -51,9 +62,10 @@ public:
   /** Read password from wallet */
   void readPassword() const;
 
-  TQString type, name, host, port, user, precommand, encryption, authType;
+  TQString type, name, host, port, user, precommand, authType;
   TQString localHostname;
   bool auth, specifyHostname;
+  EncryptionMode encryption;
 
   private:
     mutable TQString mPasswd;
@@ -119,8 +131,8 @@ private:
     TQLineEdit    *precommand;
     TQButtonGroup *encryptionGroup;
     TQRadioButton *encryptionNone;
-    TQRadioButton *encryptionSSL;
     TQRadioButton *encryptionTLS;
+    TQRadioButton *encryptionSTARTTLS;
     TQButtonGroup *authGroup;
     TQRadioButton *authPlain;
     TQRadioButton *authLogin;
@@ -149,11 +161,7 @@ private:
   SmtpWidgets     mSmtp;
   SendmailWidgets mSendmail;
   KMTransportInfo *mTransportInfo;
-  enum EncryptionMethods {
-    NoEncryption = 0,
-    SSL = 1,
-    TLS = 2
-  };
+
   enum AuthMethods {
     NoAuth = 0,
     LOGIN = 1,
@@ -164,7 +172,7 @@ private:
     GSSAPI = 32,
     AllAuth = 0xffffffff
   };
-  unsigned int mAuthNone, mAuthSSL, mAuthTLS;
+  unsigned int mAuthNone, mAuthTLS, mAuthSTARTTLS;
 };
 
 
diff --git a/kmail/listjob.cpp b/kmail/listjob.cpp
index 6c189293c..2bbd7509d 100644
--- a/kmail/listjob.cpp
+++ b/kmail/listjob.cpp
@@ -117,7 +117,7 @@ void ListJob::execute()
         escapedStatus,
         i18n("retrieving folders"),
         false,
-        mAccount->useSSL() || mAccount->useTLS() );
+        mAccount->useSTARTTLS() || mAccount->useTLS() );
     mParentProgressItem->setStatus( escapedStatus );
   }
 
diff --git a/kmail/managesievescriptsdialog.cpp b/kmail/managesievescriptsdialog.cpp
index bd8d99558..2ea4e5651 100644
--- a/kmail/managesievescriptsdialog.cpp
+++ b/kmail/managesievescriptsdialog.cpp
@@ -84,12 +84,12 @@ static KURL findUrlForAccount( const KMail::ImapAccountBase * a ) {
     u.setPort( sieve.port() );
     // Translate IMAP LOGIN to PLAIN:
     u.addQueryItem( "x-mech", a->auth() == "*" ? "PLAIN" : a->auth() );
-    if ( !a->useSSL() && !a->useTLS() )
+    if ( !a->useSTARTTLS() && !a->useTLS() )
         u.addQueryItem( "x-allow-unencrypted", "true" );
     return u;
   } else {
     KURL u = sieve.alternateURL();
-    if ( u.protocol().lower() == "sieve" && !a->useSSL() && !a->useTLS() && u.queryItem("x-allow-unencrypted").isEmpty() )
+    if ( u.protocol().lower() == "sieve" && !a->useSTARTTLS() && !a->useTLS() && u.queryItem("x-allow-unencrypted").isEmpty() )
         u.addQueryItem( "x-allow-unencrypted", "true" );
     return u;
   }
diff --git a/kmail/networkaccount.cpp b/kmail/networkaccount.cpp
index 9a5f5e993..ab432557b 100644
--- a/kmail/networkaccount.cpp
+++ b/kmail/networkaccount.cpp
@@ -55,7 +55,7 @@ namespace KMail {
       mAuth( "*" ),
       mPort( 0 ),
       mStorePasswd( false ),
-      mUseSSL( false ),
+      mUseSTARTTLS( false ),
       mUseTLS( false ),
       mAskAgain( false ),
       mPasswdDirty( false ),
@@ -78,7 +78,7 @@ namespace KMail {
     mHost = TQString();
     mPort = defaultPort();
     mStorePasswd = false;
-    mUseSSL = false;
+    mUseSTARTTLS = false;
     mUseTLS = false;
     mAskAgain = false;
   }
@@ -129,8 +129,8 @@ namespace KMail {
     mPort = port;
   }
 
-  void NetworkAccount::setUseSSL( bool use ) {
-    mUseSSL = use;
+  void NetworkAccount::setUseSTARTTLS( bool use ) {
+    mUseSTARTTLS = use;
   }
 
   void NetworkAccount::setUseTLS( bool use ) {
@@ -189,8 +189,10 @@ namespace KMail {
     setPort( port );
 
     setAuth( config.readEntry( "auth", "*" ) );
-    setUseSSL( config.readBoolEntry( "use-ssl", false ) );
-    setUseTLS( config.readBoolEntry( "use-tls", false ) );
+    // TODO(mio): Write an upgrade script to rename "use-tls" to "use-starttls".
+    setUseSTARTTLS( config.readBoolEntry( "use-tls", false ) );
+    // TODO(mio): Write an upgrade script to rename "use-ssl" to "use-tls".
+    setUseTLS( config.readBoolEntry( "use-ssl", false ));
 
     mSieveConfig.readConfig( config );
   }
@@ -245,8 +247,10 @@ namespace KMail {
     config.writeEntry( "host", host() );
     config.writeEntry( "port", static_cast<unsigned int>( port() ) );
     config.writeEntry( "auth", auth() );
-    config.writeEntry( "use-ssl", useSSL() );
-    config.writeEntry( "use-tls", useTLS() );
+    // TODO(mio): Write an upgrade script to rename "use-tls" to "use-starttls".
+    config.writeEntry( "use-tls", useSTARTTLS() );
+    // TODO(mio): Write an upgrade script to rename "use-ssl" to "use-tls".
+    config.writeEntry( "use-ssl", useTLS() );
 
     mSieveConfig.writeConfig( config );
   }
@@ -269,7 +273,8 @@ namespace KMail {
 
   MetaData NetworkAccount::slaveConfig() const {
     MetaData m;
-    m.insert( "tls", useTLS() ? "on" : "off" );
+    // COMPAT: To keep compatibility with the IOSlaves, we use "tls" for STARTTLS.
+    m.insert( "tls", useSTARTTLS() ? "on" : "off" );
     return m;
   }
 
@@ -284,7 +289,7 @@ namespace KMail {
     setHost( n->host() );
     setPort( n->port() );
     setAuth( n->auth() );
-    setUseSSL( n->useSSL() );
+    setUseSTARTTLS( n->useSTARTTLS() );
     setUseTLS( n->useTLS() );
     setSieveConfig( n->sieveConfig() );
   }
diff --git a/kmail/networkaccount.h b/kmail/networkaccount.h
index 832f68058..c53743da2 100644
--- a/kmail/networkaccount.h
+++ b/kmail/networkaccount.h
@@ -88,9 +88,9 @@ namespace KMail {
     unsigned short int port() const { return mPort; }
     virtual void setPort( unsigned short int port );
 
-    /** @return whether to use SSL */
-    bool useSSL() const { return mUseSSL; }
-    virtual void setUseSSL( bool use );
+    /** @return whether to use STARTTLS */
+    bool useSTARTTLS() const { return mUseSTARTTLS; }
+    virtual void setUseSTARTTLS( bool use );
 
     /** @return whether to use TLS */
     bool useTLS() const { return mUseTLS; }
@@ -134,7 +134,7 @@ namespace KMail {
     TQString mLogin, mPasswd, mAuth, mHost;
     unsigned short int mPort;
     bool mStorePasswd : 1;
-    bool mUseSSL : 1;
+    bool mUseSTARTTLS : 1;
     bool mUseTLS : 1;
     bool mAskAgain : 1;
     bool mPasswdDirty, mStorePasswdInConfig;
diff --git a/kmail/popaccount.cpp b/kmail/popaccount.cpp
index 97ec2b6c3..eb852cba2 100644
--- a/kmail/popaccount.cpp
+++ b/kmail/popaccount.cpp
@@ -102,7 +102,7 @@ TQString PopAccount::type(void) const
 }
 
 TQString PopAccount::protocol() const {
-  return useSSL() ? POP_SSL_PROTOCOL : POP_PROTOCOL;
+  return useTLS() ? POP_SSL_PROTOCOL : POP_PROTOCOL;
 }
 
 unsigned short int PopAccount::defaultPort() const {
@@ -403,7 +403,7 @@ void PopAccount::startJob()
     escapedName,
     i18n("Preparing transmission from \"%1\"...").arg( escapedName ),
     true, // can be canceled
-    useSSL() || useTLS() );
+    useSTARTTLS() || useTLS() );
   connect( mMailCheckProgressItem, TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem* ) ),
            this, TQ_SLOT( slotAbortRequested() ) );
 
diff --git a/kmail/searchjob.cpp b/kmail/searchjob.cpp
index 7b0b55584..bcbd4acde 100644
--- a/kmail/searchjob.cpp
+++ b/kmail/searchjob.cpp
@@ -269,7 +269,7 @@ void SearchJob::slotSearchFolder()
         i18n("Downloading emails from IMAP server"),
         i18n( "URL: %1" ).arg( TQStyleSheet::escape( mFolder->folder()->prettyURL() ) ),
         true,
-        mAccount->useSSL() || mAccount->useTLS() );
+        mAccount->useSTARTTLS() || mAccount->useTLS() );
     mProgress->setTotalItems( numMsgs );
     connect ( mProgress, TQ_SIGNAL( progressItemCanceled( KPIM::ProgressItem*)),
         this, TQ_SLOT( slotAbortSearch( KPIM::ProgressItem* ) ) );
diff --git a/kmail/sievedebugdialog.cpp b/kmail/sievedebugdialog.cpp
index 09d7d3fa1..c30c0f9bf 100644
--- a/kmail/sievedebugdialog.cpp
+++ b/kmail/sievedebugdialog.cpp
@@ -235,11 +235,11 @@ static KURL urlFromAccount( const KMail::ImapAccountBase * a ) {
 
         // Translate IMAP LOGIN to PLAIN:
         u.addQueryItem( "x-mech", a->auth() == "*" ? "PLAIN" : a->auth() );
-        if ( !a->useSSL() && !a->useTLS() )
+        if ( !a->useSTARTTLS() && !a->useTLS() )
             u.addQueryItem( "x-allow-unencrypted", "true" );
     } else {
         u = sieve.alternateURL();
-        if ( u.protocol().lower() == "sieve" && !a->useSSL() && !a->useTLS() && u.queryItem("x-allow-unencrypted").isEmpty() )
+        if ( u.protocol().lower() == "sieve" && !a->useSTARTTLS() && !a->useTLS() && u.queryItem("x-allow-unencrypted").isEmpty() )
             u.addQueryItem( "x-allow-unencrypted", "true" );
     }
     return u;
diff --git a/kmail/vacation.cpp b/kmail/vacation.cpp
index 7ad0728c5..32d960507 100644
--- a/kmail/vacation.cpp
+++ b/kmail/vacation.cpp
@@ -501,13 +501,13 @@ namespace KMail {
       u.setPass( a->passwd() );
       u.setPort( sieve.port() );
       u.addQueryItem( "x-mech", a->auth() == "*" ? "PLAIN" : a->auth() ); //translate IMAP LOGIN to PLAIN
-      if ( !a->useSSL() && !a->useTLS() )
+      if ( !a->useSTARTTLS() && !a->useTLS() )
           u.addQueryItem( "x-allow-unencrypted", "true" );
       u.setFileName( sieve.vacationFileName() );
       return u;
     } else {
       KURL u = sieve.alternateURL();
-      if ( u.protocol().lower() == "sieve" && !a->useSSL() && !a->useTLS() && u.queryItem("x-allow-unencrypted").isEmpty() )
+      if ( u.protocol().lower() == "sieve" && !a->useSTARTTLS() && !a->useTLS() && u.queryItem("x-allow-unencrypted").isEmpty() )
           u.addQueryItem( "x-allow-unencrypted", "true" );
       u.setFileName( sieve.vacationFileName() );
       return u;
diff --git a/tdeioslave/imap4/imap4.cpp b/tdeioslave/imap4/imap4.cpp
index 7d02a4890..fe26c6f23 100644
--- a/tdeioslave/imap4/imap4.cpp
+++ b/tdeioslave/imap4/imap4.cpp
@@ -170,12 +170,12 @@ sigchld_handler (int signo)
   errno = save_errno;
 }
 
-IMAP4Protocol::IMAP4Protocol (const TQCString & pool, const TQCString & app, bool isSSL):TCPSlaveBase ((isSSL ? 993 : 143),
-        (isSSL ? IMAP_SSL_PROTOCOL : IMAP_PROTOCOL), pool,
-              app, isSSL), imapParser (), mimeIO (), outputBuffer(outputCache)
+IMAP4Protocol::IMAP4Protocol (const TQCString & pool, const TQCString & app, bool isTLS):TCPSlaveBase ((isTLS ? 993 : 143),
+        (isTLS ? IMAP_SSL_PROTOCOL : IMAP_PROTOCOL), pool,
+              app, isTLS), imapParser (), mimeIO (), outputBuffer(outputCache)
 {
   outputBufferIndex = 0;
-  mySSL = isSSL;
+  myTLS = isTLS;
   readBuffer[0] = 0x00;
   relayEnabled = false;
   readBufferLen = 0;
@@ -641,7 +641,7 @@ IMAP4Protocol::setHost (const TQString & _host, int _port,
       closeConnection ();
     myHost = _host;
     if (_port == 0) 
-        myPort = (mySSL) ? ImapsPort : ImapPort;
+        myPort = (myTLS) ? ImapsPort : ImapPort;
     else 
         myPort = _port;
     myUser = _user;
@@ -2039,7 +2039,7 @@ bool IMAP4Protocol::makeLogin ()
     setState(ISTATE_CONNECT);
 
     myAuth = metaData("auth");
-    myTLS  = metaData("tls");
+    mySTARTTLS  = metaData("starttls");
     kdDebug(7116) << "myAuth: " << myAuth << endl;
 
     imapCommand *cmd;
@@ -2070,14 +2070,14 @@ bool IMAP4Protocol::makeLogin ()
 
     if (metaData("nologin") == "on") return TRUE;
 
-    if (myTLS == "on" && !hasCapability(TQString("STARTTLS")))
+    if (mySTARTTLS == "on" && !hasCapability(TQString("STARTTLS")))
     {
-      error(ERR_COULD_NOT_LOGIN, i18n("The server does not support TLS.\n"
+      error(ERR_COULD_NOT_LOGIN, i18n("The server does not support STARTTLS.\n"
         "Disable this security feature to connect unencrypted."));
       closeConnection();
       return false;
     }
-    if ((myTLS == "on" || (canUseTLS() && myTLS != "off")) &&
+    if ((mySTARTTLS == "on" || (canUseTLS() && mySTARTTLS != "off")) &&
       hasCapability(TQString("STARTTLS")))
     {
       imapCommand *cmd = doCommand (imapCommand::clientStartTLS());
@@ -2087,7 +2087,7 @@ bool IMAP4Protocol::makeLogin ()
         int tlsrc = startTLS();
         if (tlsrc == 1)
         {
-          kdDebug(7116) << "TLS mode has been enabled." << endl;
+          kdDebug(7116) << "STARTTLS mode has been enabled." << endl;
           imapCommand *cmd2 = doCommand (new imapCommand ("CAPABILITY", ""));
           for (TQStringList::Iterator it = imapCapabilities.begin ();
                                      it != imapCapabilities.end (); ++it)
@@ -2096,7 +2096,7 @@ bool IMAP4Protocol::makeLogin ()
           }
           completeQueue.removeRef (cmd2);
         } else {
-          kdWarning(7116) << "TLS mode setup has failed.  Aborting." << endl;
+          kdWarning(7116) << "STARTTLS mode setup has failed.  Aborting." << endl;
           error (ERR_COULD_NOT_LOGIN, i18n("Starting TLS failed."));
           closeConnection();
           return false;
@@ -2161,7 +2161,7 @@ bool IMAP4Protocol::makeLogin ()
     else
     {
 #ifdef HAVE_LIBSASL2
-      if (!clientAuthenticate (this, authInfo, myHost, myAuth, mySSL, resultInfo))
+      if (!clientAuthenticate (this, authInfo, myHost, myAuth, myTLS, resultInfo))
         error(TDEIO::ERR_COULD_NOT_AUTHENTICATE, i18n("Unable to authenticate via %1.\n"
 	"The server %2 replied:\n%3").arg(myAuth).arg(myHost).arg(resultInfo));
       else {
diff --git a/tdeioslave/imap4/imap4.h b/tdeioslave/imap4/imap4.h
index d264cce9d..a0529827a 100644
--- a/tdeioslave/imap4/imap4.h
+++ b/tdeioslave/imap4/imap4.h
@@ -55,7 +55,7 @@ class IMAP4Protocol:public
 public:
 
   // reimplement the TCPSlave
-  IMAP4Protocol (const TQCString & pool, const TQCString & app, bool isSSL);
+  IMAP4Protocol (const TQCString & pool, const TQCString & app, bool isTLS);
   virtual ~IMAP4Protocol ();
 
   virtual void openConnection();
@@ -186,9 +186,9 @@ private:
   void doListEntry (const TQString & encodedUrl, int stretch, imapCache * cache = NULL,
     bool withFlags = FALSE, bool withSubject = FALSE);
 
-  TQString myHost, myUser, myPass, myAuth, myTLS;
+  TQString myHost, myUser, myPass, myAuth, mySTARTTLS;
   int myPort;
-  bool mySSL;
+  bool myTLS;
 
   bool relayEnabled, cacheOutput, decodeContent;
   TQByteArray outputCache;