Re: [exim] TLS verify

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Always Learning
Datum:  
To: Exim
Betreff: Re: [exim] TLS verify

On Mon, 2015-08-03 at 14:29 +0100, Mike Cardwell wrote:

> I have an SMTP transport which looks like this:
>
> remote_smtp:
>     driver                  = smtp
>     tls_verify_certificates = /etc/ssl/certs/
>     tls_try_verify_hosts    = *
>     tls_verify_hosts        = snake.grepular.com : flan.grepular.com
>     hosts_require_tls       = snake.grepular.com : flan.grepular.com

>
> When I send an email to an address that isn't hosted on
> "snake.grepular.com" or "flan.grepular.com" and that host uses a self
> signed certificate, it fails to verify and then falls back to using
> a plain text connection. For example:
>
> 2015-08-03 14:19:37 1ZMFeT-0007Bc-Fj SSL verify error: depth=0 error=self signed certificate cert=/C=EU/ST=European Union/L=Europa/O=U226.com/OU=Network Operations/CN=m2.u226.com/emailAddress=www.query@gmail.com
> 2015-08-03 14:19:37 1ZMFeT-0007Bc-Fj TLS error on connection to m2.u22.net [95.172.15.115] (SSL_connect): error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
> 2015-08-03 14:19:37 1ZMFeT-0007Bc-Fj TLS session failure: delivering unencrypted to m2.u22.net [95.172.15.115] (not in hosts_require_tls)
>
> Have I misunderstood something about how tls_try_verify_hosts is
> supposed to work? I'm using Exim 4.84 with OpenSSL.


The self-signed certificate's server no longer has an A record. The MTA
identify was changed some months ago.

Other mails arrive 'normally'. Examples:

-----------------------------------------------
Received: from flan.grepular.com ([198.211.125.252]:47379) by m2.u22.net
        with esmtp (Exim 4.63) (envelope-from <zzzzzzz@zzzzzzzz>) id
        1ZMFeU-00013U-MZ for zzzzz@zzzzz; Mon, 03 Aug 2015 14:19:38
+0100
------------------------------------
Received: from hummus.csx.cam.ac.uk ([131.111.8.88]:38061) by m2.u22.net
        with esmtps (TLSv1:RC4-SHA:128) (Exim 4.63) (envelope-from
        <exim-users-bounces+zzzzzzzz>) id 1ZMFol-00013q-11 for
        zzzzz@zzzzzzz; Mon, 03 Aug 2015 14:30:15 +0100
------------------------------------
Received: from cluster-f.mailcontrol.com ([85.115.62.190]:53168) by
        m2.u22.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63)
(envelope-from
        <zzzzzzzzzzz>) id 1ZMCPk-0000qv-Sz for zzzzzzzzzz; Mon,
        03 Aug 2015 10:52:12 +0100
-----------------------------------------------


Logwatch shows

2015-08-01 16:38:58 TLS error on connection from flan.grepular.com
[198.211.125.252]:38235 (SSL_accept): error:14094418:SSL
routines:SSL3_READ_BYTES:tlsv1 alert unknown ca: 1 Time(s)


--
Regards,

Paul.
England, EU.      England's place is in the European Union.