Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My exim server is showing the following error: TLS error on connection from xxxx.xxxx.xxxx. ([127.0.0.1]) [xxx.xxx.xxx.xxx] (gnutls_handshake): A TLS fatal alert has been received.

I'm using the plain authentication and my settings are :

plain_server:
  driver = plaintext
  public_name = PLAIN
  server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  server_set_id = $auth2
  server_prompts = :
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
     server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

Looking forward to any help or pointers

thanks in advance

share|improve this question
    
Anyone know how to get more detail on that TLS fatal alert, or would I have to run exim under a debugger to get any more detail? –  Boyd Stephen Smith Jr. Feb 7 at 22:48

2 Answers 2

Let me guess: you've compiled against GnuTLS, the mailserver you're talking to is GMX.de or web.de, and the problem started a few weeks ago? Both these providers turned on TLS in response to the NSA issue, but they didn't quite get it right.

As a workaround, you can compile exim against OpenSSL which is more tolerant, but do note that the problem is with GMX and web.de.

share|improve this answer
1  
It started at my server's exim4 installation some days ago. Debian Wheezy. I'm using CACert.org as root CA. –  koppor Feb 28 '14 at 18:35
    
As I understand it, this causes a slightly different error message and only occurs if you've somehow blocked TLSv1. @koppor –  Boyd Stephen Smith Jr. Feb 7 at 22:04
    
Yeah, the error message for that is: TLS error on connection from ... (gnutls_handshake): Could not negotiate a supported cipher suite. @koppor –  Boyd Stephen Smith Jr. Feb 8 at 16:33
    
Ref for above: blog.windfluechter.net/comment/3019 –  Boyd Stephen Smith Jr. Feb 8 at 16:40

If you are running an exim installation, the reason was GnuTLS here. Solution found at http://blog.josefsson.org/2009/04/16/cacert-and-gnutls/.

Type following commands

  1. apt-get install gnutls-bin to have gnutls-cli available.
  2. gnutls-cli -s -p 25 YOURSMTPHOST (starts a session with your mailserver)
  3. ehlo foo
  4. starttls
  5. Press CTRL+d (^d)

Then you see something like

- The hostname in the certificate does NOT match 'example.org'

Then the subject of your certificate does not match your server YOURSMTPHOST. In my case, I connected to flupp.de, but the CN of the certificate was *.flupp.de. I changed flupp.de to mail.flupp.de and everyhting worked fine again.

share|improve this answer
    
My certificate was for smtp.domain, but my MX record and the HELO indicated host.domain. However, after addressing that, I still receive this error in the logs. @koppor –  Boyd Stephen Smith Jr. Feb 7 at 22:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.