Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My exim server is showing the following error: TLS error on connection from xxxx.xxxx.xxxx. ([]) [] (gnutls_handshake): A TLS fatal alert has been received.

I'm using the plain authentication and my settings are :

  driver = plaintext
  public_name = PLAIN
  server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  server_set_id = $auth2
  server_prompts = :
     server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}

Looking forward to any help or pointers

thanks in advance

share|improve this question
Anyone know how to get more detail on that TLS fatal alert, or would I have to run exim under a debugger to get any more detail? – Boyd Stephen Smith Jr. Feb 7 '15 at 22:48

If you are running an exim installation, the reason was GnuTLS here. Solution found at

Type following commands

  1. apt-get install gnutls-bin to have gnutls-cli available.
  2. gnutls-cli -s -p 25 YOURSMTPHOST (starts a session with your mailserver)
  3. ehlo foo
  4. starttls
  5. Press CTRL+d (^d)

Then you see something like

- The hostname in the certificate does NOT match ''

Then the subject of your certificate does not match your server YOURSMTPHOST. In my case, I connected to, but the CN of the certificate was * I changed to and everyhting worked fine again.

share|improve this answer
My certificate was for smtp.domain, but my MX record and the HELO indicated host.domain. However, after addressing that, I still receive this error in the logs. @koppor – Boyd Stephen Smith Jr. Feb 7 '15 at 22:05
This might not have helped the original poster, but it did help me. The difference I suppose, is that I'm trying to test STARTTLS on a test server, using the live server's SSL cert. And, well, that just won't work until the test server becomes the live server. – Ernie May 20 '15 at 18:05
the commands listed were perfect to verify that this was my problem too, which I suspected. excellent answer! – user9999999 Sep 25 '15 at 23:31

Let me guess: you've compiled against GnuTLS, the mailserver you're talking to is or, and the problem started a few weeks ago? Both these providers turned on TLS in response to the NSA issue, but they didn't quite get it right.

As a workaround, you can compile exim against OpenSSL which is more tolerant, but do note that the problem is with GMX and

share|improve this answer
It started at my server's exim4 installation some days ago. Debian Wheezy. I'm using as root CA. – koppor Feb 28 '14 at 18:35
As I understand it, this causes a slightly different error message and only occurs if you've somehow blocked TLSv1. @koppor – Boyd Stephen Smith Jr. Feb 7 '15 at 22:04
Yeah, the error message for that is: TLS error on connection from ... (gnutls_handshake): Could not negotiate a supported cipher suite. @koppor – Boyd Stephen Smith Jr. Feb 8 '15 at 16:33
Ref for above: – Boyd Stephen Smith Jr. Feb 8 '15 at 16:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.