Questions tagged [starttls]

STARTTLS is the SMTP command to connect to email servers securely over TLS (formerly SSL). Use with an email server tag like [postfix], [exchange], etc.

32 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
6k views

LDAP with TLS: connect error(-11)

I configured OpenLDAP and today I've configured the TLS for more security following these guide lines: Configure OpenLDAP with TLS=required Modifying the cn=config.ldif with config file: dn: cn=...
Neil's user avatar
  • 355
4 votes
0 answers
461 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
Mike B's user avatar
  • 12k
3 votes
0 answers
197 views

Postfix STARTTLS works in LAN but not externally

if I connect in LAN on port 25 to my mail server, it offers STARTTLS telnet mailserver.com 25 Trying 192.168.0.x... Connected to mailserver.com Escape character is '^]'. 220 mailserver.com ESMTP ...
Florian's user avatar
  • 59
2 votes
0 answers
33 views

postfix wrappermode depending on destination

My ISP accepts mail on port 465 thus requiring smtp_tls_wrappermode = yes. However, I also have another internal server, to which I forward mail on port 25 using STARTTLS, but with ...
Lars Hanke's user avatar
2 votes
1 answer
125 views

CentOS OpenLDAP STARTTLS wierdness

I am having a very strange problem configuring my CentOS OpenLDAP for STARTTLS. Here's what's going on. I have a bunch os scripts that I use to configure my system. I do this to document a machine's ...
Mister Rose's user avatar
2 votes
0 answers
783 views

Does Google require TLS on port 587? Exchange 2010 SMTP has mail sent to GMAIL backed up in queue

Exchange 2010 SMTP has mail backed up in queue. Any email sent to Gmail sits in the queue while any email sent to another personal domain which has email filtering enabled errors, "asp.reflexion.net ...
Bilal's user avatar
  • 21
1 vote
0 answers
759 views

How to (properly) force the use of SSL or STARTTLS in OpenLDAP?

I have successfully managed to configure my OpenLDAP (which is an Apple Open Directory variant, but that should not matter) to work with both, SSL (ldaps on port 636) as well as STARTTLS (on port 389)....
not2savvy's user avatar
  • 207
1 vote
0 answers
982 views

Personal OpenSMTPd relay fails when using "tls-require", works fine with just "tls"

I'm currently setting up a somewhat unique personal email server using OpenSMTPd. I have a local server (Raspberry Pi) and a remote server (VPS). Emails sent to me are sent to the remote server and ...
Josey's user avatar
  • 11
1 vote
0 answers
142 views

Can't configure SMTP encryption - postfix

I have docker-mailserver and Roundcube in containers, beside there is MySQL database for mail data and user passwords. Dovecot inside is configured to verify logging in users passwords with database. ...
pbies's user avatar
  • 169
1 vote
1 answer
1k views

Deny non TLS incoming mail with postfix and force certificate check

I want to deny non TLS incoming mails on my postfix server. Here is what i've done: smtpd_tls_security_level = encrypt smtpd_tls_auth_only = yes I do not really understand the difference between ...
Bob5421's user avatar
  • 381
1 vote
1 answer
225 views

Postfix bounce when unable to validate TLS option

I'm using postfix as mail transfer agent on my mailgateway to send and receive emails. Because I'm communicating with sensitive information I'm using the tls options to validate the receivers mx. He ...
Nico's user avatar
  • 135
1 vote
0 answers
251 views

Server 2012 R2 SMTP service not sending mail to non TLS servers

We have SMTP virtual server on server 2012 R2 server. I have configured it to use TLS connection. We do have real sertificate etc. Everything works fine except mail that is going to mail server which ...
Timo77's user avatar
  • 131
1 vote
1 answer
175 views

I'm able send email via Thunderbird, but not via my own app. The email settings are identical

I have my Postfix server. I can send email via it with no problem using Thunderbird. For smtp I have: port - 587 Normal Password STARTTLS However, I can't send an email through the same server via ...
Poddiri's user avatar
  • 11
1 vote
1 answer
621 views

Trying to make submission (587) work - Exchange 2016

I'm trying to allow the authenticated relay (Client Frontend connector) to process requests from LAN and internet, but I'm struggling so far. First, I have linked this connector to my SSL wildcard ...
Nemesis's user avatar
  • 31
1 vote
0 answers
442 views

Postfix TLS Roundcube problems

im writing this because i have a problem when i try to test SMTP with Roundcube. Before i had no problem with Postfix ou Dovecot. It seems like it's a TLS problem : SMTP Test When i look in my log ...
Maxime.c's user avatar
1 vote
0 answers
1k views

Postfix with Dovecot Disconnects after STARTTLS on Port 25

I am having a lot of trouble setting up the Postfix to do STARTTLS. It seems that I could successfully send outgoing mail using Thunderbird. However, I can't seem to get the Postman SMTP for Wordpress ...
cs378's user avatar
  • 123
1 vote
0 answers
70 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
makerofthings7's user avatar
1 vote
0 answers
651 views

Postfix - SASLAuthentication Problems Cram-MD5 with StartTLS

Recently I configured my mail server which uses Postfix and Courier. Everything works except for the authentication when sending mail via my Postfix server(running on port 587) which has StartTLS ...
Martin's user avatar
  • 111
1 vote
1 answer
1k views

Thunderbird STARTTLS fails connecting to Cyrus-IMAP 2.2.13

Today all of a sudden my Icedove mail clients (38.7.0) ceased working using STARTTLS after I renewed the server certificate. Plain text IMAP works fine. The server logs STARTTLS negotiation failed ...
Lars Hanke's user avatar
0 votes
0 answers
175 views

Is Certificates are required for STARTTLS connection on LDAP

My LDAP server's ldap.conf file # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=coretesting,dc=com URI ldap://ldap....
ram ajay's user avatar
0 votes
1 answer
740 views

Unable to start STARTTLS in PowerMTA server

We have PowerMTA v5.5r1 installed on Ubuntu 22.04 server. When I tried to telnet localhost with 25 port I am unable to see 250-STARTTLS option. Please help which parameter or configuration needs to ...
Sachin Kadam's user avatar
0 votes
0 answers
225 views

Why exim does not use TLS when sends email to remote SMTP?

Here what exim does when sends emails to gmail and other SMTP severs Received: from ns01.virtex.kz (ns1.virtex.kz. [185.141.164.16]) by mx.google.com with ESMTP id i11-...
Falseclock's user avatar
0 votes
1 answer
763 views

Cannot get Mutt/Gmail/OAuth2 to work - cannot STARTTLS

I'm trying to get Mutt working with Gmail using OAuth2. I'm using Debian 10 and have compiled Mutt 2.2.1 with --enable-smtp. I've created my tokens. My muttrc contains: set smtp_oauth_refresh_command=&...
John Percival's user avatar
0 votes
0 answers
1k views

tls negotiation failed the certificate doesn't match the host

I'm tryin to setup Gmail send-as to send email via my SMTP server over TLS and I get "tls negotiation failed the certificate doesn't match the host" ever since I renewed my lets encrypt cert....
eng3's user avatar
  • 177
0 votes
0 answers
2k views

NSS-LDAP not working over TLS: do_open: do_start_tls failed:stat=-1

I'm using NSS-LDAP for authentication. Without TLS, everything works fine. Once I enable TLS (StartTLS) with a self-signed certificate, which I have added to the client, NSS-LDAP won't connect to the ...
jacobz's user avatar
  • 101
0 votes
1 answer
37 views

Will msmtp fallback to unencrypted connections if encrypted connections fail?

My ~/.msmtprc config file says to connect to a server on port 25 with tls on and tls_starttls on. Is there a risk that, if the encrypted connection setup fails for some reason, then msmtp will ...
a3nm's user avatar
  • 919
0 votes
0 answers
206 views

Apache and TLS mode - password in plain text in wireshark

My apache.config: LDAPTrustedMode TLS LDAPTrustedGlobalCert CERT_BASE64 /etc/pki/tls/certs/ca.cer AllowOverride None Options None #Order allow,deny #Allow from ...
overflowed's user avatar
0 votes
1 answer
710 views

Ambari sync with LDAP using StartTLS

I'm facing an issue to sync Ambari with a LDAP server using StartTLS and a self-signed certificate. Ambari server and ldap server are both running on the same machine. I've followed the steps written ...
JeremyJJ's user avatar
0 votes
1 answer
726 views

SMTP Server (Exchange 2003) hangs up on client after STARTTLS command after adding cert

I am stumped on this. I have Exchange Server 2003 still in use. I created a valid LetsEncrypt SSL cert, and successfully imported the pfx in my Default SMTP Virtual Server properties, Access tab. ...
Brian B's user avatar
  • 111
-1 votes
0 answers
63 views

Security concerns with self-signed Xerox device certificates during SMTP transfer

I am trying to find out what risks there are in a SMTP connection which uses a self-signed certificate for TLS. The setup is a Xerox MFP which is being used to send emails for scan to email ...
user1078006's user avatar
-1 votes
2 answers
2k views

Is TLS necessary for port 25 for MX delivery?

I am in the process of implementing a new Postfix implementation on an existing environment which is extremely old. While doing so I am requiring all clients to connect securely on either 465 or 587 ...
Michael Moser's user avatar
-1 votes
1 answer
535 views

Gitlab with OpenLDAP secured with TLS

I have a working, secure OpenLDAP server running at: auth.<company name>.com I also have a reader account that Gitlab can use: cn=Reader Reader,ou=users,dc=auth,dc=<Company name>,dc=com ...
Andrew M.'s user avatar