Questions tagged [starttls]
STARTTLS is the SMTP command to connect to email servers securely over TLS (formerly SSL). Use with an email server tag like [postfix], [exchange], etc.
115
questions
6
votes
3
answers
2k
views
SNI like equivalent for starttls
I am trying to host two seperate domains on one IP address. I want to be able to determine from the STARTTLS command which certificate was being requested and forward to a different mail server based ...
user420606
3
votes
2
answers
2k
views
Disabling SSLv2 in Courier IMAP
I'm attempting to disable SSLv2 support (amongst other things) in Courier on Linux. In /etc/courier/imapd-ssl I have:
TLS_CIPHER_LIST="HIGH:!MEDIUM:!SSLv2:!LOW:!EXP:!aNULL:!ADH:@STRENGTH:!3DES"
...
- 31
0
votes
1
answer
9k
views
Can't connect to Exchange 2016 with port 587 TLS
Hi everyone i'm having issues with SMTP notifications connecting on port 587 with TLS.
Right now I have an internal Exchange 2016 server and all email works great. I have a few customers who have ...
3
votes
1
answer
1k
views
Postfix TLS encryption: smtp_* vs smptd_*
I am really confused about the postfix TLS settings. There are in each case settings for private keys and public keys.
smtpd_tls_cert_file =
smtpd_tls_key_file =
smtpd_*
And
smtp_tls_cert_file =
...
- 177
3
votes
2
answers
4k
views
Configure OpenLDAP using GnuTLS with TLS=required
We have an openldap server and don't want to allow unencrypted communication, so acceptable is either tls over port 389 (starttls) or ssl over 636 (ldaps).
As we use slapd.conf for configuration, ...
- 33
1
vote
0
answers
445
views
Postfix TLS Roundcube problems
im writing this because i have a problem when i try to test SMTP with Roundcube. Before i had no problem with Postfix ou Dovecot.
It seems like it's a TLS problem :
SMTP Test
When i look in my log ...
- 11
0
votes
1
answer
1k
views
How to force postfix to deny all non TLS queries?
I have a server with postfix and a plain text authentication.
It accepts both TLS and non-TLS authentication.
How can I force the server to deny all non TLS queries so that the mail users never send ...
12
votes
3
answers
54k
views
Postfix configure to use TLSv1.2
I start build my first cloud server: Ubuntu 16.04 with postfix.
Question is how can i configure postfix to use TLSv1.2 when i send mail from my webshop?
When my webshop sending mail to my postfix ...
- 143
0
votes
1
answer
2k
views
Unable to send email from Command Line in Postfix (warning: TLS library .....)
I configured postfix with ssl/tls. and created an smtp. However I am unable to send test email and/or login.
"Text below first defines error log (different attempts) and then configuration files."
...
- 63
-1
votes
1
answer
72
views
Does anything changes for a client in the API communication after the command STARTTLS is sent and a response received
I'm trying to understand how the command STARTTLS in IMAP works exactly and what becomes different when it's sent. After I've sent the command "STARTTLS" before login process and received the response ...
- 113
1
vote
2
answers
5k
views
Exim client not issuing STARTTLS when connecting to smarthost
I have a Debian8 server running exim4 that sends outgoing mail by smarthost through NameCheap's mail.privateemail.com smtp server - or at least it use to. After a recent update, the server no longer ...
- 101
2
votes
1
answer
12k
views
ssmtp settings for namecheap: Invalid response SMTP Server (STARTTLS)
I am trying to configure ssmtp to use the namecheap smtp server to send emails. My current configuration:
[email protected]
mailhub=mail.privateemail.com:465
rewriteDomain=email.com
hostname=email....
- 189
2
votes
2
answers
11k
views
How to force STARTTLS in Exim?
I am learning to set up a mailserver. I got it working with postfix, now trying the same configuration with Exim. How can I force a client to take up only STARTTLS connection for SMTP outgoing ...
- 123
2
votes
1
answer
1k
views
Properly Configure Postfix to be secure (SASL + TLS)
I've followed online tutorials online to setup my mail server with SASL and TLS, and amavis.
It all seems to works - except i can send mails even if i don't authenticate first - which is not good.
I ...
- 167
1
vote
1
answer
2k
views
Thunderbird STARTTLS fails connecting to Cyrus-IMAP 2.2.13
Today all of a sudden my Icedove mail clients (38.7.0) ceased working using STARTTLS after I renewed the server certificate. Plain text IMAP works fine.
The server logs STARTTLS negotiation failed ...
- 305
0
votes
2
answers
3k
views
I can't send a message with postfix. Error: "Must issue STARTTLS first"
I am novice with postfix. My goal is to use it with fan/nagios/centreon in order to receive notifications.
I have tried many solutions found on this forum or thanks to google, but it didn't resolve my ...
- 1
9
votes
2
answers
13k
views
Postfix "Trusted TLS connection established" but "Server certificate not verified"
I´m using a Postfix TLS Policy to enforce TLS for outgoing email. Unfortunately in some cases the certificate verification fails and I don´t know why.
For instance, this is an excerpt of my TLS Policy
...
- 569
1
vote
0
answers
1k
views
Postfix with Dovecot Disconnects after STARTTLS on Port 25
I am having a lot of trouble setting up the Postfix to do STARTTLS. It seems that I could successfully send outgoing mail using Thunderbird. However, I can't seem to get the Postman SMTP for Wordpress ...
- 123
1
vote
1
answer
1k
views
Enabling STARTTLS for all on Postfix with Zarafa
I ran into a problem which I just cannot solve with just googling it - I need some expert help.
My company runs it's own mailserver (postfix with zarafa groupware). We're an insurance company so we ...
user333222
0
votes
1
answer
713
views
STARTTLS sendmail handshake failures on SMTP and retries
I'd like to gracefully handle sendmail STARTTLS handshake failures. On outgoing mail, it would be best if there were an immediate retry without STARTTLS in the case of failure. On inbound mail, ...
- 1
3
votes
0
answers
202
views
Postfix STARTTLS works in LAN but not externally
if I connect in LAN on port 25 to my mail server, it offers STARTTLS
telnet mailserver.com 25
Trying 192.168.0.x...
Connected to mailserver.com
Escape character is '^]'.
220 mailserver.com ESMTP ...
- 59
2
votes
1
answer
780
views
Validate email address at my own domain with gmail
I need to have the ability to send email using gmail's web interface, but have them appear to originate from my own domain instead of originating at a gmail address. In order to do this, gmail asks ...
- 120
1
vote
0
answers
70
views
Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?
I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains.
companyA.com MX myAlias.whitelabel.com
companyb.com MX ...
- 8,961
2
votes
2
answers
1k
views
SVN Edge not authenticating correctly with domain controller
SVN Edge (version 4.0.10-3880.131) not authenticating correctly with domain controller.
I have SVN Edge setup and working perfectly when I use LDAP Security Level of NONE..
However when set to SSL, ...
- 121
1
vote
1
answer
593
views
Drop non-TLS connection on EXIM
How to restrict access to EXIM to clients with STARTTLS? I want to be able to drop non-TLS connections.
Current setup:
tls_on_connect_ports = 465
tls_advertise_hosts = *
tls_certificate = /some/...
- 11
5
votes
1
answer
2k
views
How to mitigate STARTTLS MITM (downgrading and forged certificates) between email servers?
I'm not as technically inclined as most on this site so please keep that in mind. I wanted to learn more about email security so I did some research and everything is according to my understanding, ...
- 51
0
votes
1
answer
3k
views
Dovecot STARTTLS fails using fetchmail
I currently try to get my own mail server up and running. So far everything seems fine as I am able to connect to this mailserver using thunderbird. The only thing I have to do is accepting my own (...
- 101
1
vote
1
answer
239
views
Verify TLS encryped communication when querying LDAP server?
I have a web application (not hosted on windows) that authenticates users by querying an LDAP server (a windows domain controller). The app is configured to use STARTTLS to encrypt communication with ...
- 11
-1
votes
1
answer
535
views
Gitlab with OpenLDAP secured with TLS
I have a working, secure OpenLDAP server running at:
auth.<company name>.com
I also have a reader account that Gitlab can use:
cn=Reader Reader,ou=users,dc=auth,dc=<Company name>,dc=com
...
0
votes
1
answer
240
views
SMTP doesn't work on distinct machine [closed]
I'm trying to setup TLS e-mail on remote machine, but it doesn't work.
Trying to send e-mail on my local machine (Windows 7 x64 locale ru-ru):
16:33:18 CONNECT : Looking up host name mail....
- 101
5
votes
1
answer
15k
views
Postfix STARTTLS only on port 25
I want to enable STARTTLS on port 25, but for unknown reasons it only works on port 465.
master.cf:
smtp inet n - - - - smtpd
-o syslog_name=postfix/smtp
-o ...
- 1,259
3
votes
1
answer
12k
views
How to disable SSLv3 in Postfix 2.11?
I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration.
My current config in Postfix 2.11.2:
# inbound
smtpd_tls_security_level = may
...
- 2,096
5
votes
0
answers
6k
views
LDAP with TLS: connect error(-11)
I configured OpenLDAP and today I've configured the TLS for more security following these guide lines: Configure OpenLDAP with TLS=required
Modifying the cn=config.ldif with config file:
dn: cn=...
- 355
10
votes
1
answer
36k
views
Postfix Recipient address rejected: Access denied Error
Trying to use zend mail smtp to send email from my php app login authenticated and give me this constant error I don't have to deal with I look into de 36 question here on serverfault.com changing ...
- 391
2
votes
0
answers
783
views
Does Google require TLS on port 587? Exchange 2010 SMTP has mail sent to GMAIL backed up in queue
Exchange 2010 SMTP has mail backed up in queue. Any email sent to Gmail sits in the queue while any email sent to another personal domain which has email filtering enabled errors,
"asp.reflexion.net ...
- 21
4
votes
0
answers
472
views
How can I explicitly disable TLS when sending to one specific recipient?
I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet)
I have TLS configured for the first three hosts. ...
- 12k
0
votes
1
answer
485
views
starttls fails after IP address change
I have changed the IP address of our exim mail server (the virtual machine has been copied to a different host, also the network configuration is using NAT). Now it no longer accepts STARTTLS ...
- 1,336
1
vote
1
answer
313
views
How can I explicitly force SendMail to not use SSLv3 for STARTTLS connections?
SendMail 8.14.x
With SSLv3 being sunset (to put it lightly), I'd like to ensure that my SendMail servers aren't using it when establishing STARTTLS connections. Is there a way I can force SendMail to ...
- 12k
0
votes
1
answer
975
views
Exim says "The request is invalid" during gnutls_handshake
I have Debian wheezy and setup Exim to listen to port 587, where users can authenticate using TLS. I'm testing it with Thunderbird 31.1.2. When I try to send a message, Thunderbird displays this:
...
- 2,626
1
vote
1
answer
910
views
postfix cannot communicate with target server via TLS/SSL
I am able to connect my postfix server with TLS. All things are set up. But when i send a message with this secure connection, target server (for example gmail) receive my message without TLS/SSL ...
- 144
-3
votes
1
answer
70
views
no STARTTLS in inbound email to exim [closed]
I have a CentOS VPS and I'm using Exim 4.7.2
For some days I have an issue in Thunderbird and in other client because seems STARTTLS not work in incoming email only outgoing e-mail.
How can I fix ...
- 1
17
votes
2
answers
5k
views
Is it still "wrong" to require STARTTLS on incoming SMTP messages
According to the STARTTLS Spec Section 5:
A publicly-referenced SMTP server MUST NOT require use of the
STARTTLS extension in order to deliver mail locally. This rule
prevents the STARTTLS extension ...
- 293
1
vote
3
answers
4k
views
Exim after Thunderbird update: "Could not negotiate a supported cipher suite" [closed]
Recently, after I installed updates on my Kubuntu 14.04. system and a new version of thunderbird was installed, I could not send emails any more. It prompts:
Sending of message failed. The message ...
- 177
3
votes
3
answers
18k
views
Postfix still complains that "certificate verification failed" even when "smtp_tls_security_level = fingerprint"
I'm attempting to use Postfix (version 2.6.6 on RHEL6) to connect to and send mail via a mail relay on our internal network. I want to connect with STARTTLS on port 25 (port 465 is not available on ...
- 185
2
votes
1
answer
4k
views
How can I enforce TLS in sendmail when I don't necessarily know the hostname of the downstream MTA (only IPs)? [e.g. by recipients' domain]
I'm running SendMail 8.14 and have some custom static routes for sending to certain domains. These domains are "internal" but not managed directly by me.
Here's an example of /etc/mail/mailertable:...
- 12k
0
votes
1
answer
1k
views
SMTP Connection disconnecting after "STARTTLS"
We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver.
After some debugging using telnet and looking through the logfiles, it ...
- 101
5
votes
2
answers
7k
views
ejabberd starttls_required in c2s/s2s and disable SSLv3 + unsecure Ciphers
I'm using ejabberd on Ubuntu.
My configuration looks like this:
{5269, ejabberd_s2s_in, [
{shaper, s2s_shaper},
{max_stanza_size, 131072},
...
- 407
74
votes
8
answers
88k
views
Is STARTTLS less safe than TLS/SSL?
In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS".
As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
- 889
1
vote
0
answers
654
views
Postfix - SASLAuthentication Problems Cram-MD5 with StartTLS
Recently I configured my mail server which uses Postfix and Courier. Everything works except for the authentication when sending mail via my Postfix server(running on port 587) which has StartTLS ...
- 111
2
votes
3
answers
29k
views
Postfix & Gmail: Authentication Required error
I configured Postfix using this guide. When I send a test E-Mail I get the following error message:
May 23 15:36:26 VM11 postfix/smtp[15321]: connect to smtp.gmail.com[2a00:1450:4001:c02::6d]:587: ...
- 135