Hello Viktor, Hello Jeremy,
and all others helping me, to find the problem with my exim not able to deliver to the
https://blog.lindenberg.one/EmailSecurityTest .
I tried now a lot of things, and learned a lot about debugging this kind of error.
As the biggest problem lies into the test-mechanism, which introduces all kinds of simulated errors,
no offering of STARTTLS etc., it was hard, teting against that.
So finally I have created a testenvironment, which had all the destinations with and without DANE,
letsencrypt etc. I created identical looking self signed certs, removed the usual BasicConstraints
CA=FALSE, which all my self-signed certs have, so my cert looked just the same.
But I could deliver to any of my systems destinations, after my DANE-DNSSEC problem was fixed.
So I went another way, diving into the command line tools of GnuTLS, instead of OpenSSL, which was
as long my tools for all those tests. But as the error only occured in GnuTLS, those tools could
help me:
Testing the test-systems self-signed cert, I needed to start some tries, till I got finally STARTTLS
offered, and there was a single line more, as in the exim debug output:
gnutls-cli -d 9999 -V -p 25 85.215.77.84 --starttls-proto=smtp
ASSERT: ../../lib/tls-sig.c[_gnutls_check_key_usage_for_sig]:58
Peer's certificate does not allow digital signatures. Key usage violation detected.
*** Fatal error: Key usage violation in certificate has been detected
Doing the same to my test-destination for the self-signed cert:
gnutls-cli -d 9999 -V -p 25 78.46.150.68 --starttls-proto=smtp
Status: The certificate is NOT trusted. The name in the certificate does not match the expected.
*** Fatal error: Error in the certificate
reads totally different, as my current test exim would even accept a non matching name.
No other error popped out.
Ok, I compared the the certs again and they just looked identical:
X.509 Certificate Information: X.509 Certificate Information:
Version: 3 Version: 3
Serial Number (hex): 1780f0f593e5c453adbb0ace8a352a65f85d9da7 Serial Number (hex): 31553a407b3f80ae791c3b01fc6a5c9e68f0c371
Issuer: OU=GnuTLS test,O=xxxxxxxxxxxxxxx,L=Karlsruhe,ST=BW,C=DE Issuer: CN=et.lindenberg.one,OU=Tests,O=Lindenberg,L=Karlsruhe,ST=BW,C=DE
Validity: Validity:
Not Before: Sat Jul 13 18:08:35 UTC 2024 Not Before: Sat Jan 22 16:08:03 UTC 2022
Not After: Tue Jul 11 18:08:35 UTC 2034 Not After: Fri Jan 17 16:08:03 UTC 2042
Subject: CN=xxxxxxx.sxxxxxxxxxxxxxx.de,OU=GnuTLS test,O=xxxxxxxxxxxxxx,L=Karlsruhe,ST=BW,C=DE Subject: CN=et.lindenberg.one,OU=Tests,O=Lindenberg,L=Karlsruhe,ST=BW,C=DE
Subject Public Key Algorithm: RSA Subject Public Key Algorithm: RSA
Algorithm Security Level: Medium (2048 bits) Algorithm Security Level: Medium (2048 bits)
Modulus (bits 2048): Modulus (bits 2048):
[....] [....]
61:5b:e1:86:ad:c5:a3:e8:9b:ff:88:65:69:53:8a:95 14:81:25:a0:df:75:74:82:e8:db:76:18:c9:0a:ca:b9
c7 07
Exponent (bits 24): Exponent (bits 24):
01:00:01 01:00:01
Extensions: Extensions:
Key Usage (not critical): Key Usage (not critical):
Key encipherment. Key encipherment.
Data encipherment. Data encipherment.
Key Purpose (not critical): Key Purpose (not critical):
TLS WWW Server. TLS WWW Server.
Subject Alternative Name (not critical): Subject Alternative Name (not critical):
DNSname: xxxxx.xxxxx.sxxxxx.de DNSname: *.et.lindenberg.one
DNSname: xxxxx.xxxxx.sxxxxx.de DNSname: et.lindenberg.one
DNSname: *.xxxxx.sxxxxx.de
Signature Algorithm: RSA-SHA256 Signature Algorithm: RSA-SHA256
Signature: Signature:
[....] [....]
6a:16:a5:0e:86:79:f1:0c:5f:db:63:13:82:b3:db:e7 db:68:0f:df:1b:ef:53:58:b8:c8:dd:f6:d5:5b:22:db
Other Information: Other Information:
Fingerprint: Fingerprint:
sha1:b2d9d5fc60263a7a733aa993778c145df58440e9 sha1:65129aa12c4226f8a4990fd09088bf1196938449
sha256:e7b0677097872807e59c24997f82f378f4f32afde4812efee53e08df4cd9870f sha256:bb0a27ff46c96f4a230b83a1042d1aef8f18ed535c0a483597887be91dec3a69
Public Key ID: Public Key ID:
sha1:f941e8850872dd4d5912a2049fc71962b0323c25 sha1:957bd584e2baef6521b0d53b81b5bd449662c1c4
sha256:38dfdab913903310a1860505688f7bbf18344a0d4e6f79e3ef2ef19ea5d7aac1 sha256:fe950f86708244329b4675b7adc120ee2d3f66a90c01449c8c24fea99f3e2909
Public Key PIN: Public Key PIN:
pin-sha256:ON/auROQMxChhgUFaI97vxg0Sg1Ob3nj7y7xnqXXqsE= pin-sha256:/pUPhnCCRDKbRnW3rcEg7i0/ZqkMAUScjCT+qZ8+KQk=
When I check now my certificate:
certtool -i -d 9999 -V -e --verify-profile high --infile=gnutls-test03.crt
I get only a warning:
Output: Not verified. The certificate is NOT trusted. The certificate issuer is unknown
When I check the testinstance certificate, I get this output:
Chain verification output: Not verified. The certificate is NOT trusted.
The certificate chain violates the signer's constraints.
There must be some more bits in the certs, which I was till now not able to get shown by any tool.
But for me the case is closed, as it looks like, that its a very ugly hidden glitch in the self-signed cert,
OpenSSL is tolerating, GnuTLS not!
Again thanks a lot for all the assistance, helping the through this research!
Regards
Wolfgang
--
## subscription configuration (requires account):
##
https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@???
## Exim details at
http://www.exim.org/
## Please use the Wiki with this list -
http://wiki.exim.org/
