5

My exim server is showing the following error: TLS error on connection from xxxx.xxxx.xxxx. ([127.0.0.1]) [xxx.xxx.xxx.xxx] (gnutls_handshake): A TLS fatal alert has been received.

I'm using the plain authentication and my settings are :

plain_server:
  driver = plaintext
  public_name = PLAIN
  server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  server_set_id = $auth2
  server_prompts = :
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
     server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

Looking forward to any help or pointers

thanks in advance

Improve this question
1
  • Anyone know how to get more detail on that TLS fatal alert, or would I have to run exim under a debugger to get any more detail?
    – Boyd Stephen Smith Jr.
    Feb 7, 2015 at 22:48

2 Answers 2

Reset to default
10

If you are running an exim installation, the reason was GnuTLS here. Solution found at http://blog.josefsson.org/2009/04/16/cacert-and-gnutls/.

Type following commands

  1. apt-get install gnutls-bin to have gnutls-cli available.
  2. gnutls-cli -s -p 25 YOURSMTPHOST (starts a session with your mailserver)
  3. ehlo foo
  4. starttls
  5. Press CTRL+d (^d)

Then you see something like

- The hostname in the certificate does NOT match 'example.org'

Then the subject of your certificate does not match your server YOURSMTPHOST. In my case, I connected to flupp.de, but the CN of the certificate was *.flupp.de. I changed flupp.de to mail.flupp.de and everyhting worked fine again.

Improve this answer
3
  • My certificate was for smtp.domain, but my MX record and the HELO indicated host.domain. However, after addressing that, I still receive this error in the logs. @koppor
    – Boyd Stephen Smith Jr.
    Feb 7, 2015 at 22:05
  • This might not have helped the original poster, but it did help me. The difference I suppose, is that I'm trying to test STARTTLS on a test server, using the live server's SSL cert. And, well, that just won't work until the test server becomes the live server.
    – Ernie
    May 20, 2015 at 18:05
  • 1
    the commands listed were perfect to verify that this was my problem too, which I suspected. excellent answer!
    – simpleuser
    Sep 25, 2015 at 23:31
1

Let me guess: you've compiled against GnuTLS, the mailserver you're talking to is GMX.de or web.de, and the problem started a few weeks ago? Both these providers turned on TLS in response to the NSA issue, but they didn't quite get it right.

As a workaround, you can compile exim against OpenSSL which is more tolerant, but do note that the problem is with GMX and web.de.

Improve this answer
4
  • 1
    It started at my server's exim4 installation some days ago. Debian Wheezy. I'm using CACert.org as root CA.
    – koppor
    Feb 28, 2014 at 18:35
  • As I understand it, this causes a slightly different error message and only occurs if you've somehow blocked TLSv1. @koppor
    – Boyd Stephen Smith Jr.
    Feb 7, 2015 at 22:04
  • Yeah, the error message for that is: TLS error on connection from ... (gnutls_handshake): Could not negotiate a supported cipher suite. @koppor
    – Boyd Stephen Smith Jr.
    Feb 8, 2015 at 16:33
  • Ref for above: blog.windfluechter.net/comment/3019
    – Boyd Stephen Smith Jr.
    Feb 8, 2015 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .