Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl:

The server is postfix

235 2.7.0 Authentication successful

250 2.1.0 Ok
depth=0 /C=AU/ST=NSW/L=Sydney/O=Self-Signed Key! Procees with caution!/OU=Web Hosting/
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=AU/ST=NSW/L=Sydney/O=Self-Signed Key! Procees with caution!/OU=Web Hosting/
verify return:1
554 5.5.1 Error: no valid recipients

but, the thing is, if I just do a vanilla telnet over port 25 I can authenticate and send mail like a madman... hopefully this is enough information! (as opposed to ' can't handle ssl!')

share|improve this question
Not by a long shot. Provide the output from postconf -n and the relevant part of your mail log (the part containing the entire transaction from beginning to end). – adaptr Dec 1 '11 at 12:58
Have you tried another RCPT TO: – Andy Smith Dec 1 '11 at 12:58
possible duplicate of Exim TLS and Secure SMTP – jj33 Dec 1 '11 at 14:53
Ooh, I like the automatic comments when you flag as a dupe, nice touch. It's not super obvious that the questions are duplicates since they're using different MTAs and @lol didn't say that he was using s_client to test, but he is, and they are =) – jj33 Dec 1 '11 at 14:55
really, you're beautiful people. you can have a doctorate in methods in computing but if you simply are not well versed in using programs you still need community help! I <3 stack overflow. In terms of the actual duplicate post - what should I do? (since the tags and the title in no way reflect what is actually going on in the tty) ...? – lol Dec 1 '11 at 15:04
up vote 21 down vote accepted

Pressing "R" in an s_client session causes openssl to renegotiate. Try entering "rcpt to:" instead of "RCPT TO".

You might also try tools that are more suited to SMTP-specific testing, such as Tony Finch's smtpc or swaks.

share|improve this answer
+1 for case sensitivity... you're never too old to forget what is and isn't case sensitive! – lol Dec 1 '11 at 15:08
To be clear, s_client is just wrong here. You were correct in principle for using "RCPT TO". It's completely braindead that a plain text "R", in a tool that's made for typing text into, causes a renegotiate. The fact that you can get around it by using "rcpt to" is just a way to work around the bug/poor implementation decision in s_client. – jj33 Dec 1 '11 at 15:11
Thanks, I will keep that in mind - I'm migrating from a play server -> a production one (with real ssl!) and so I haven't used all the security tools before, just learned about the unsecured transport protocols :) – lol Dec 2 '11 at 5:27
Oh my goodness. OpenSSL, what did you smoke? :'( – Max Ried Dec 30 '14 at 22:36
It’s behavior that could be useful, but on by default? When I saw the message I assumed the renegotiation was caused by the server and there was a bug there. (Sorry for this “me too!” post) – binki Nov 5 '15 at 21:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.