Questions tagged [starttls]
STARTTLS is the SMTP command to connect to email servers securely over TLS (formerly SSL). Use with an email server tag like [postfix], [exchange], etc.
111
questions
1
vote
0
answers
51
views
How to (properly) force the use of SSL or STARTTLS in OpenLDAP?
I have successfully managed to configure my OpenLDAP (which is an Apple Open Directory variant, but that should not matter) to work with both, SSL (ldaps on port 636) as well as STARTTLS (on port 389)....
- 206
0
votes
0
answers
118
views
Unable to start STARTTLS in PowerMTA server
We have PowerMTA v5.5r1 installed on Ubuntu 22.04 server. When I tried to telnet localhost with 25 port I am unable to see 250-STARTTLS option.
Please help which parameter or configuration needs to ...
0
votes
0
answers
68
views
Why exim does not use TLS when sends email to remote SMTP?
Here what exim does when sends emails to gmail and other SMTP severs
Received: from ns01.virtex.kz (ns1.virtex.kz. [185.141.164.16])
by mx.google.com with ESMTP id i11-...
- 11
0
votes
1
answer
234
views
Nginx mail proxy: tls between the proxy and the server?
When using the Nginx Mail Proxy feature to realize an SMTP proxy, there are several options available to configure (start)tls between the client and the proxy.
However, it appears between the proxy ...
- 101
0
votes
2
answers
1k
views
PHP8 ldap_bind : Error -1 Can't contact LDAP server
I m on almalinux 8.7 with PHP8.
Test ldapsearch with TLS is ok
ldapsearch -H ldap://xxxx -x -ZZ /etc/pki/tls/certs/xxxx.pem -D 'xxxxx' -w 'xxxx' -b 'cn=xxx,cn=users,dc=xxx,dc=xxxx'
But ldap_bind won'...
- 145
0
votes
1
answer
641
views
sendmail does not issue STARTTLS when acting as a client
I'm having problems relaying to servers that whise mail is routed through mimecast. Connections are being rejected with the message:
553 This route requires encryption (TLS) - https://community....
- 2,299
1
vote
1
answer
1k
views
Mail server sending to postfix refusing TLS connection with "certificate expired", but it's not
Since April 30, I'm seeing errors like that in my mail log:
May 1 02:27:27 afaron postfix/smtpd[2644268]: connect from r137.info.hofer.at[66.117.17.137]
May 1 02:27:27 afaron postfix/smtpd[2644268]: ...
- 161
1
vote
0
answers
549
views
Personal OpenSMTPd relay fails when using "tls-require", works fine with just "tls"
I'm currently setting up a somewhat unique personal email server using OpenSMTPd. I have a local server (Raspberry Pi) and a remote server (VPS). Emails sent to me are sent to the remote server and ...
- 11
0
votes
1
answer
658
views
Cannot get Mutt/Gmail/OAuth2 to work - cannot STARTTLS
I'm trying to get Mutt working with Gmail using OAuth2.
I'm using Debian 10 and have compiled Mutt 2.2.1 with --enable-smtp.
I've created my tokens.
My muttrc contains:
set smtp_oauth_refresh_command=&...
1
vote
0
answers
122
views
Can't configure SMTP encryption - postfix
I have docker-mailserver and Roundcube in containers, beside there is MySQL database for mail data and user passwords. Dovecot inside is configured to verify logging in users passwords with database. ...
- 169
0
votes
0
answers
716
views
tls negotiation failed the certificate doesn't match the host
I'm tryin to setup Gmail send-as to send email via my SMTP server over TLS and I get "tls negotiation failed the certificate doesn't match the host" ever since I renewed my lets encrypt cert....
- 157
1
vote
1
answer
3k
views
Postfix is getting "TLS Is required, but was not offered by host"
I've searched every forum, every article, every serverfault.com post for this issue. I'm using a fresh setup of Postfix. It is managed by Virtualmin. Whenever I try to send mail via TLS, I get the ...
- 41
2
votes
2
answers
415
views
TLS/SSL on http (80) with STARTTLS
I'm researching the reason why TLS/SSL is not using over HTTP. Other protocols, such as SMTP, POP3, FTP, etc can be used on SSL ports (SMTPS, POP3S, FTPS) for the first way, and the second way is to ...
- 21
0
votes
1
answer
315
views
does SSL/TLS STARTLS full encrypt connexion for POP and IMAP
I am configuring POP and IMAP accounts in thunderbird mail client.
Here are 2 options:
Security:
None
SSL/TLS
STARTLS
Authentication method:
Normal password
Encrypted password
Kerberos / GSSAPI
...
- 299
1
vote
1
answer
2k
views
Using stunnel as proxy between SSL versions for SMTP with STARTTLS
I have a quite old software which doesn't support TLS 1.2. However SMTP Server only supports TLS 1.2.
Now I wanted to use stunnel to connect to SMTP server and and also listening for smtp access. I ...
- 307
3
votes
3
answers
5k
views
Why is port 587 preferred over port 465 in SMTP?
I have recently been developing a C# client which sends emails via a SMTP server.
However I have been as to what the different terms ment, like: STARTTLS/TLS/SSL... I had a faint idea of what they ...
- 45
1
vote
1
answer
96
views
Gmail failing to accept TLS
I recently set up a postfix mail server. Testing it with other domains, everything seems to work well.
However, when my server tries to send messages to gmail, they are marked as spam, with the red ...
- 21
0
votes
1
answer
595
views
Are SMTPS and IMAPS ports really deprecated?
I've read that STARTTLS command was added and intended to deprecate the SSL ports. But even major mail servers like google still use SSL ports and even don't allow us to use classic ports with ...
0
votes
1
answer
811
views
How to read an OpenSSL cipher suite list
hMailserver is an open source Window e-mail server. For incoming e-mail it supports STARTTLS with the help of OpenSSL 1.1.1.
It allows configuring the cipher suites, the default is:
ECDHE-RSA-AES128-...
- 236
2
votes
1
answer
2k
views
Postfix 3.3.1 on Centos 8 can't enable TLSv1 or TLSv1.1
I recently migrated my main mail server to a new one, the old one had been running for almost 10 years and was the production server for around 20 domains and over 40 mailboxes.
Everything went well ...
- 63
2
votes
1
answer
1k
views
Getting postfix to relay SMTP/SSL/TLS to Charter/Spectrum
I'm running Postfix on Debian as an MX for a small LAN and trying to get SMTPS working with mobile.charter.net over port 587. I followed a few links off google for setting this up along with a post on ...
- 199
0
votes
0
answers
1k
views
NSS-LDAP not working over TLS: do_open: do_start_tls failed:stat=-1
I'm using NSS-LDAP for authentication. Without TLS, everything works fine. Once I enable TLS (StartTLS) with a self-signed certificate, which I have added to the client, NSS-LDAP won't connect to the ...
- 101
-1
votes
1
answer
492
views
Outlook 2010 can receive but not send - authentication fails - Thunderbird works
After the mailserver was upgraded from CentOS6 to CentOS 7, Outlook 2010 on Windows 7 can receive email but not send, the error says authentication failed. However Mozilla Thunderbird can receive and ...
- 99
1
vote
1
answer
761
views
Deny non TLS incoming mail with postfix and force certificate check
I want to deny non TLS incoming mails on my postfix server.
Here is what i've done:
smtpd_tls_security_level = encrypt
smtpd_tls_auth_only = yes
I do not really understand the difference between ...
- 299
0
votes
1
answer
29
views
Will msmtp fallback to unencrypted connections if encrypted connections fail?
My ~/.msmtprc config file says to connect to a server on port 25 with tls on and tls_starttls on. Is there a risk that, if the encrypted connection setup fails for some reason, then msmtp will ...
- 859
-1
votes
1
answer
5k
views
Postfix 3.4.9 SSL issues -- no shared cipher from servers using TLSv1
Edit 1: I've narrowed it down to TLSv1 that both servers listed below (no others have failed yet) are attempting to use. I'll be contacting their webmasters requesting they stop using an insecure ...
- 9
0
votes
0
answers
169
views
Apache and TLS mode - password in plain text in wireshark
My apache.config:
LDAPTrustedMode TLS
LDAPTrustedGlobalCert CERT_BASE64 /etc/pki/tls/certs/ca.cer
AllowOverride None
Options None
#Order allow,deny
#Allow from ...
- 115
0
votes
1
answer
791
views
TLS from unknown: No client certificate presented
We have setup a windows server virtual SMTP (under IIS6 manager). In the SMTP settings, TLS encryption is enabled, fqdn field is "sharepoint.mycompany.com".
In the server's cert store "personal" ...
- 217
2
votes
1
answer
119
views
CentOS OpenLDAP STARTTLS wierdness
I am having a very strange problem configuring my CentOS OpenLDAP for STARTTLS. Here's what's going on.
I have a bunch os scripts that I use to configure my system. I do this to document a machine's ...
- 21
2
votes
1
answer
832
views
Do any reputable mail servers require STARTTLS encryption for SMTP delivery?
Are there any large, reputable MTAs (like gmail, hotmail, icloud, etc) that will bounce mail or otherwise fail to deliver if the receiving MTA doesn't support STARTTLS?
Put another way, will ...
- 309
1
vote
1
answer
190
views
Postfix bounce when unable to validate TLS option
I'm using postfix as mail transfer agent on my mailgateway to send and receive emails.
Because I'm communicating with sensitive information I'm using the tls options to validate the receivers mx. He ...
- 135
1
vote
0
answers
230
views
Server 2012 R2 SMTP service not sending mail to non TLS servers
We have SMTP virtual server on server 2012 R2 server. I have configured it to use TLS connection. We do have real sertificate etc. Everything works fine except mail that is going to mail server which ...
- 131
0
votes
1
answer
666
views
Ambari sync with LDAP using StartTLS
I'm facing an issue to sync Ambari with a LDAP server using StartTLS and a self-signed certificate. Ambari server and ldap server are both running on the same machine. I've followed the steps written ...
- 1
0
votes
1
answer
3k
views
No STARTTLS with Dovecot and Postfix
I have done a lot of searching and am not finding a solution.
I had to reload Mageia 6 on my email server. I am using dovecot-2.2.34-1.mga6 and postfix-3.1.6-1.mga6. Openssl is openssl-1.0.2o-1....
1
vote
1
answer
153
views
I'm able send email via Thunderbird, but not via my own app. The email settings are identical
I have my Postfix server. I can send email via it with no problem using Thunderbird. For smtp I have:
port - 587
Normal Password
STARTTLS
However, I can't send an email through the same server via ...
- 11
1
vote
1
answer
538
views
Trying to make submission (587) work - Exchange 2016
I'm trying to allow the authenticated relay (Client Frontend connector) to process requests from LAN and internet, but I'm struggling so far.
First, I have linked this connector to my SSL wildcard ...
- 31
3
votes
3
answers
8k
views
Client did not present a certificate (Postfix)
I have postfix SMTP relay which have been configured with TLS option. Now just realized when sending email to gmail (for example) using Microsoft outlook,found out this "Client did not present a ...
- 117
2
votes
1
answer
8k
views
Postfix STARTTLS encryption before authentication
I'm trying my best to configure Postfix with STARTTLS using port 25. Now the problem is STARTTLS is not working on port 25.
250-VRFY
250-ETRN
250-XXXXXXXA
250-AUTH PLAIN LOGIN
250-...
- 117
1
vote
1
answer
381
views
Mail server: Does /etc/mailname have to match SSL certificate CN?
I set up a web and email server on a VPS that uses apache2 with multiple virtual hosts and postfix, dovecot, and roundcube for the email server. I am getting an authentication failure when trying to ...
- 51
1
vote
1
answer
5k
views
postfix tls not reading or finding key
I've been having issues sending mail to my server, and there are indications of TLS errors (mostly from the maillog).
What I've tried:
Ensuring that postfix / dovecot can read the certificates (made ...
user353390
3
votes
1
answer
195
views
Sendmail process crashes as soon as STARTTLS is received
I just upgraded my server from FreeBSD 10.3 to 11.1. It's now running Sendmail 8.15.2 and OpenSSL 1.0.2k-freebsd 26 Jan 2017.
Since the upgrade, sending mail to my server is failing. I cranked up ...
- 291
-1
votes
2
answers
2k
views
Is TLS necessary for port 25 for MX delivery?
I am in the process of implementing a new Postfix implementation on an existing environment which is extremely old. While doing so I am requiring all clients to connect securely on either 465 or 587 ...
- 219
0
votes
1
answer
600
views
SMTP Server (Exchange 2003) hangs up on client after STARTTLS command after adding cert
I am stumped on this. I have Exchange Server 2003 still in use. I created a valid LetsEncrypt SSL cert, and successfully imported the pfx in my Default SMTP Virtual Server properties, Access tab. ...
- 111
0
votes
1
answer
51
views
Does DNS need to be pointed toward the right sever, for SSL to work
So the issue I'm having, is with a new mail server I've been setting up. Now it seems to work fine when not using ssl. And if I try using ssl, with a mail client like airmail it says host name ...
- 3
7
votes
2
answers
6k
views
How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?
For the purpose of troubleshooting, I need to see what an email looks like when it's sent to my sendmail server via SMTP. The upstream server requires the SMTP connection to use STARTTLS so a packet ...
- 11.8k
6
votes
3
answers
2k
views
SNI like equivalent for starttls
I am trying to host two seperate domains on one IP address. I want to be able to determine from the STARTTLS command which certificate was being requested and forward to a different mail server based ...
user420606
3
votes
1
answer
1k
views
Disabling SSLv2 in Courier IMAP
I'm attempting to disable SSLv2 support (amongst other things) in Courier on Linux. In /etc/courier/imapd-ssl I have:
TLS_CIPHER_LIST="HIGH:!MEDIUM:!SSLv2:!LOW:!EXP:!aNULL:!ADH:@STRENGTH:!3DES"
...
- 31
0
votes
1
answer
8k
views
Can't connect to Exchange 2016 with port 587 TLS
Hi everyone i'm having issues with SMTP notifications connecting on port 587 with TLS.
Right now I have an internal Exchange 2016 server and all email works great. I have a few customers who have ...
3
votes
1
answer
1k
views
Postfix TLS encryption: smtp_* vs smptd_*
I am really confused about the postfix TLS settings. There are in each case settings for private keys and public keys.
smtpd_tls_cert_file =
smtpd_tls_key_file =
smtpd_*
And
smtp_tls_cert_file =
...
- 177
3
votes
2
answers
3k
views
Configure OpenLDAP using GnuTLS with TLS=required
We have an openldap server and don't want to allow unencrypted communication, so acceptable is either tls over port 389 (starttls) or ssl over 636 (ldaps).
As we use slapd.conf for configuration, ...
- 33