4

My exim server is showing the following error: TLS error on connection from xxxx.xxxx.xxxx. ([127.0.0.1]) [xxx.xxx.xxx.xxx] (gnutls_handshake): A TLS fatal alert has been received.

I'm using the plain authentication and my settings are :

plain_server:
  driver = plaintext
  public_name = PLAIN
  server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  server_set_id = $auth2
  server_prompts = :
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
     server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

Looking forward to any help or pointers

thanks in advance

  • Anyone know how to get more detail on that TLS fatal alert, or would I have to run exim under a debugger to get any more detail? – Boyd Stephen Smith Jr. Feb 7 '15 at 22:48
5

If you are running an exim installation, the reason was GnuTLS here. Solution found at http://blog.josefsson.org/2009/04/16/cacert-and-gnutls/.

Type following commands

  1. apt-get install gnutls-bin to have gnutls-cli available.
  2. gnutls-cli -s -p 25 YOURSMTPHOST (starts a session with your mailserver)
  3. ehlo foo
  4. starttls
  5. Press CTRL+d (^d)

Then you see something like

- The hostname in the certificate does NOT match 'example.org'

Then the subject of your certificate does not match your server YOURSMTPHOST. In my case, I connected to flupp.de, but the CN of the certificate was *.flupp.de. I changed flupp.de to mail.flupp.de and everyhting worked fine again.

  • My certificate was for smtp.domain, but my MX record and the HELO indicated host.domain. However, after addressing that, I still receive this error in the logs. @koppor – Boyd Stephen Smith Jr. Feb 7 '15 at 22:05
  • This might not have helped the original poster, but it did help me. The difference I suppose, is that I'm trying to test STARTTLS on a test server, using the live server's SSL cert. And, well, that just won't work until the test server becomes the live server. – Ernie May 20 '15 at 18:05
  • 1
    the commands listed were perfect to verify that this was my problem too, which I suspected. excellent answer! – simpleuser Sep 25 '15 at 23:31
1

Let me guess: you've compiled against GnuTLS, the mailserver you're talking to is GMX.de or web.de, and the problem started a few weeks ago? Both these providers turned on TLS in response to the NSA issue, but they didn't quite get it right.

As a workaround, you can compile exim against OpenSSL which is more tolerant, but do note that the problem is with GMX and web.de.

  • 1
    It started at my server's exim4 installation some days ago. Debian Wheezy. I'm using CACert.org as root CA. – koppor Feb 28 '14 at 18:35
  • As I understand it, this causes a slightly different error message and only occurs if you've somehow blocked TLSv1. @koppor – Boyd Stephen Smith Jr. Feb 7 '15 at 22:04
  • Yeah, the error message for that is: TLS error on connection from ... (gnutls_handshake): Could not negotiate a supported cipher suite. @koppor – Boyd Stephen Smith Jr. Feb 8 '15 at 16:33
  • Ref for above: blog.windfluechter.net/comment/3019 – Boyd Stephen Smith Jr. Feb 8 '15 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.