Re: [exim] if you use openssl v3+ with exim

Am 09.12.22 um 13:21 schrieb Jeremy Harris via Exim-users:
> On 09/12/2022 10:43, Jeremy Harris via Exim-users wrote:
>>
>> The message looks like a courtesy note only, saying "I'm no longer prepared to
>>
>> TLS-renegotiate this sort of connection"; something that TLS endpoints have always
>>
>> been permitted to do for any class of TLS connection, and not implying a fault.
>>
>
> Having looking around the code, it does look like the "TLS session" bit
> implies Exim's smtp transport, with a conn fail.  I'll investigate
> further.
>
> It'd help to get a debug trace for such a connection, so I can see detail
> on the TLS operations for re-creation of the condition.

It's not an exim error message, it upstreams from openssl into the logs.

If a TLS connect is done to an outdated server using the old
renegotiation methode,
openssl 3 ends the connection with that error messge.

The root cause for this, is a change in the default config compiled
intothe openssl executable.
For OpenSSL 3 in 2021 they pulled in a patch to enable the check routine
for this old renegotiation bug from 2009.
In Openssl 1 it stayed turned off. Upgrading a os from openssl 1 to 3
will auto enable this check and bring this error
to the logs.

so, if you use openssl 3 and see this error message:

2022-12-09 10:23:22 1p3ZbF-003Bdo-2L == XXXXXXXX <X@Y> R=dnslookup
T=remote_smtp defer (-37) H=mailin2.Z.z.z [a.b.c.d]: TLS session:
(SSL_connect): error:0A000152:SSL routines::unsafe legacy renegotiation
disabled

you need to contact the receiver and inform it , that hes using an
outdated mailserver software with MITM enabling ageold security holes.

best reagards,
Marius