I have changed the IP address of our exim mail server (the virtual machine has been copied to a different host, also the network configuration is using NAT). Now it no longer accepts STARTTLS connection from a Windows Thunderbird client. It works with all other mail clients though.
The Thunderbird error message is something like can't set up a secure connection to mail.mydomain.de using STARTTLS, because the server is not offering this function. Disable STARTTLS or contact your provider
. However the exim mail server does offer STARTTLS and it still works on the old system.
Here is an excerpt from the exim debug log:
27666 accept: condition test succeeded
27666 SMTP>> 220 s0107.mydomain.de ESMTP (Exim 4.77) Fri, 31 Oct 2014 05:23:27 +0100
27666 Process 27666 is ready for new message
27666 smtp_setup_msg entered
27666 SMTP<< EHLO [192.168.1.115]
27666 sender_fullhost = ip-123-123-123-123.hsi07.unitymediagroup.de ([192.168.1.115]) [123.123.123.123]
27666 sender_rcvhost = ip-123-123-123-123.hsi07.unitymediagroup.de ([123.123.123.123] helo=[192.168.1.115])
27666 set_process_info: 27666 handling incoming connection from ip-123-123-123-123.hsi07.unitymediagroup.de ([192.168.1.115]) [123.123.123.123]
27666 host in pipelining_advertise_hosts? yes (matched "*")
27666 host in auth_advertise_hosts? yes (matched "*")
27666 host in tls_advertise_hosts? yes (matched "*")
27666 SMTP>> 250-s0107.mydomain.de Hello ip-123-123-123-123.hsi07.unitymediagroup.de [123.123.123.123]
27666 250-SIZE 52428800
27666 250-PIPELINING
27666 250-AUTH PLAIN LOGIN CRAM-MD5
27666 250-STARTTLS
27666 250 HELP
27666 SMTP<< QUIT
27666 SMTP>> 221 s0107.mydomain.de closing connection
27666 LOG: smtp_connection MAIN
27666 SMTP connection from ip-178-200-216-217.hsi07.unitymediagroup.de ([192.168.1.115]) [123.123.123.123] closed by QUIT
27666 search_tidyup called
27654 child 27666 ended: status=0x0
27654 0 SMTP accept processes now running
27654 Listening...
On the original system the last few lines look like this:
2362 250-SIZE 52428800
2362 250-PIPELINING
2362 250-AUTH PLAIN LOGIN CRAM-MD5
2362 250-STARTTLS
2362 250 HELP
2362 SMTP<< STARTTLS
2362 setting SSL CTX options: 0x800
2362 tls_certificate file /etc/pki/tls/exim_tls/exim.cert
2362 tls_privatekey file /etc/pki/tls/exim_tls/exim.key
...
It seems to be a client issue, but I have no idea why the IP address change should have any effect on the STARTTLS handshake. Please advise.
STARTTLS
but the client behaves as if it never saw it. Some firewalls do content changing on the data stream, and some of those redactSTARTTLS
because they feel they can't keep such a secure eye on an encrypted data stream. You could test this by doing, on the client,telnet mail.server 25
, thenehlo s0107.mydomain.de
and confirming that theSTARTTLS
offer reaches the client.STARTTLS
string with250-XXXXXXXA
. When I use port 587 instead of 25 the string is not filtered and the starttls handshake works.