ERROR: An error occurred while attempting to establish an SSL or TLS connection in Postal smtp #1458

winsta · 2021-07-20T07:39:14Z

winsta
Jul 20, 2021

can't connect postal SMTP via tls Its shows an error.
Connected to smtp://mydomain:25/?starttls=always
<< 220 mydomain ESMTP Postal/SVYGBU

EHLO [172.31.10.74]
<< 250-My capabilities are
<< 250-STARTTLS
<< 250 AUTH CRAM-MD5 PLAIN LOGIN
STARTTLS
<< 220 Ready to start TLS
ERROR: An error occurred while attempting to establish an SSL or TLS connection.
This usually means that the SSL certificate presented by the server is not trusted by the system for one or more of
the following reasons:

The server is using a self-signed certificate which cannot be verified.
The local system is missing a Root or Intermediate certificate needed to verify the server's certificate.
A Certificate Authority CRL server for one or more of the certificates in the chain is temporarily unavailable.
The certificate presented by the server is expired or invalid.
It is also possible that the set of SSL/TLS protocols supported by the client and server do not match.
See https://github.com/jstedfast/MailKit/blob/master/FAQ.md#SslHandshakeException for possible solutions.

See SMTP server configuration in postal.yml
smtp_server:
tls_enabled: true
tls_certificate_path: /etc/letsencrypt/live/domain/fullchain.pem
tls_private_key_path: /etc/letsencrypt/live/domain/privkey.pem

@willpower232

willpower232 · 2021-07-20T15:49:50Z

willpower232
Jul 20, 2021
Collaborator

If you have recently changed the config file, you will need to restart Postal to apply the changes.

Have you changed the ciphers or anything under those lines of config?

Can the postal user definitely access those certificate files you have mentioned?

0 replies

winsta · 2021-07-21T10:38:02Z

winsta
Jul 21, 2021
Author

tls working fine but when i test smtp then show me this error

Error: OpenSSL::SSL::SSLError (hostname "myhost.com" does not match the server certificate)

0 replies

rccess · 2021-07-21T10:43:16Z

rccess
Jul 21, 2021

run the command

openssl s_client -connect myhost.com:25 -starttls smtp

and paste the output

0 replies

winsta · 2021-07-21T10:49:07Z

winsta
Jul 21, 2021
Author

CONNECTED(00000005)
depth=0 C = GB, O = Default, OU = Default, CN = default
verify error:num=18:self signed certificate
verify return:1
depth=0 C = GB, O = Default, OU = Default, CN = default
verify return:1

Certificate chain
0 s:C = GB, O = Default, OU = Default, CN = default
i:C = GB, O = Default, OU = Default, CN = default

Server certificate
-----BEGIN CERTIFICATE-----
MIIC/zCCAeegAwIBAgIBADANBgkqhkiG9w0BAQsFADBDMQswCQYDVQQGEwJHQjEQ
MA4GA1UECgwHRGVmYXVsdDEQMA4GA1UECwwHRGVmYXVsdDEQMA4GA1UEAwwHZGVm
YXVsdDAeFw0yMTA3MjEwNDA3MzJaFw0zMTA3MTkwNDA3MzJaMEMxCzAJBgNVBAYT
AkdCMRAwDgYDVQQKDAdEZWZhdWx0MRAwDgYDVQQLDAdEZWZhdWx0MRAwDgYDVQQD
DAdkZWZhdWx0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+xXUO1o
A31g0RVmxXWh3G/Q/Ur9Vg6J8xarrOR9iMr5NwlGqfgoUqJVCnCPVCjZykJbRRHQ
KJFv0vvjqHt7qPNWEY6t9wK60YoY+3MV4Fib17ku3xbs1K5obSwCq+INYkQs8YdA
Sndjn5DmFctq/66i8l8QSmh3SBG2QSTFv8+XTV+p40MdPy7OzbCwoizuJIsbx5+2
i+BwdmAplZLOkojHv/HeVihI43onPpKHuUBhNuJWMYs8imQnYd6g9qPXWUWUoujo
5ogmuhiLfKSysaNbHS7LZgpZocOK7DHAV4Ng2n4swiXAt1CCBAwmYhS4lQyME8e9
Ia40+EjM9pjk5wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBT9AhURKhsNRUyRJcQ
OaU6v+YfCEOSJx8kBK9ojKAfUe4jL+tSTxPxidObnYfg8m7dbajM9PzJniJAvtOb
GQAXH3a9VoRGSAtCl/Bsz28KHIvwRsBPJXQcD765LPHBPl0z9uOpEzrGYOm9IzLz
OQTwGNdWHwiSP/D+0MQG89vvJTtWyS0cRIZt1AxPXQBNWSKasSUxo1iYOqibRybm
ptlHVMW/yMH0KA+vcIjytYfkLze07mzSSXPeKDniheLenqwKXD4LjvzstouQeekm
14SWCpn24FJoJa095AWeRLk0ypAfjInok2mHUGJP8SJQEUau22+56Uv9qn2dX1Xs
NWr1
-----END CERTIFICATE-----
subject=C = GB, O = Default, OU = Default, CN = default

issuer=C = GB, O = Default, OU = Default, CN = default

No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: DH, 1024 bits

SSL handshake has read 1791 bytes and written 553 bytes
Verification error: self signed certificate

New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-GCM-SHA384
Session-ID: 4395A31B347D85C4661FBF0AA6F786FBD9380104E66E8B061E7FD4276D9D5880
Session-ID-ctx:
Master-Key: 375C37BDCD2ADC25442DF56078FEA4A9FEA0963EF59DA627D59C1EA17C330015 34AF34368F645C4B17D5B5391D8FFB57
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 45 35 cc 7d 82 47 ef 3b-91 58 84 43 5c 5b 7e 87 E5.}.G.;.X.C[~.
0010 - 5f f5 15 b6 18 3d 53 5b-a0 62 69 a6 1f 6c f5 eb _....=S[.bi..l..
0020 - 74 99 c7 1a 08 71 d6 2a-0c a4 e9 82 ef 0c 64 27 t....q.*......d'
0030 - 0b f4 ee 06 b0 2f a4 23-f0 e8 b4 58 6e 63 d4 be ...../.#...Xnc..
0040 - be cb 72 bf f9 dd 27 72-b1 7a 86 69 73 61 e7 2d ..r...'r.z.isa.-
0050 - 92 77 97 49 92 85 f0 97-3c 65 d0 28 c1 dd b6 6e .w.I....<e.(...n
0060 - 63 4b d3 97 76 ca f5 7e-72 3e 55 a2 65 86 d6 d7 cK..v..~r>U.e...
0070 - 72 04 d4 d2 7f 4d dc 89-70 e9 f2 60 a4 2f 49 75 r....M..p.../Iu 0080 - 98 ee d3 52 aa 79 4b c0-7d 99 47 ec 34 8e a2 19 ...R.yK.}.G.4... 0090 - ac fb 53 4e 3b b9 6d c9-09 f4 ed 13 1f e9 fd 36 ..SN;.m........6 00a0 - 46 9f 94 fd 98 76 1b b3-d5 9a b4 2b 5c d5 5b 68 F....v.....+\.[h 00b0 - d2 60 d4 cf 32 80 4c c2-83 b3 dc 36 96 d5 56 f7 ...2.L....6..V.

Start Time: 1626864436
Timeout   : 7200 (sec)
Verify return code: 18 (self signed certificate)
Extended master secret: no

250 AUTH CRAM-MD5 PLAIN LOGIN

0 replies

rccess · 2021-07-21T11:14:06Z

rccess
Jul 21, 2021

try to send on 587 for tls

0 replies

winsta · 2021-07-21T11:21:28Z

winsta
Jul 21, 2021
Author

140663099892160:error:0200206F:system library:connect:Connection refused:../crypto/bio/b_sock2.c:110:
140663099892160:error:2008A067:BIO routines:BIO_connect:connect error:../crypto/bio/b_sock2.c:111:
connect:errno=111

i get this.

0 replies

rccess · 2021-07-21T11:32:23Z

rccess
Jul 21, 2021

try this

smtp_server:
port: 587
tls_enabled: true
tls_certificate_path: /etc/letsencrypt/live/domain/fullchain.pem
tls_private_key_path: /etc/letsencrypt/live/domain/privkey.pem

0 replies

winsta · 2021-07-21T11:52:35Z

winsta
Jul 21, 2021
Author

postal not working if i put port 587

0 replies

rccess · 2021-07-21T11:59:55Z

rccess
Jul 21, 2021

check the logs and paste screenshot here of error

0 replies

winsta · 2021-07-21T12:10:59Z

winsta
Jul 21, 2021
Author

0 replies

rccess · 2021-07-22T06:07:31Z

rccess
Jul 22, 2021

please do send the screenshot of postal.yml

Note: Please do hide private information in Screenshot or code

0 replies

willpower232 · 2021-07-22T20:09:04Z

willpower232
Jul 22, 2021
Collaborator

Can the postal user definitely access those certificate files you have mentioned?

0 replies

aps124 · 2024-05-28T13:36:45Z

aps124
May 28, 2024

I'm also facing the same issue. this is my yml file

smtp_server:
default_bind_address: "0.0.0.0"
port: 587
default_health_server_port: 9091
default_health_server_bind_address: 127.0.0.1
tls_enabled: true
tls_certificate_path: /opt/postal/config/smtp.cert
tls_private_key_path: /opt/postal/config/smtp.key
tls_ciphers:
ssl_version: SSLv23
max_message_size: 14

0 replies

rakurtz · 2024-07-17T07:50:29Z

rakurtz
Jul 17, 2024

Hello i am writing this answer because i also struggled to establish a working TLS setup for SMTP.

These are the steps i took to make it work.

i copied the the certificates from caddy to the correct folder in postal and changed permissions accordingly:

cp /opt/postal/caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/postal.mydomain.eu/postal.mydomain.eu.crt /opt/postal/config/smtp.crt

cp /opt/postal/caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/postal.mydomain.eu/postal.mydomain.eu.key /opt/postal/config/smtp.key

chmod o+r /opt/postal/config/smtp.*

after that i altered my postal.yaml to this:

smtp_server:
  default_bind_address: "::"
  tls_enabled: true
  tls_certificate_path: /config/smtp.crt
  tls_private_key_path: /config/smtp.key
  tls_ciphers:
  ssl_version: SSLv23

please note: the path starts with /. in some other posts here on GitHub discussions you would find the paths without a beginning slash.

Stop and restarted postal.

first i encountered some error messages when running this command openssl s_client -connect postal.mydomain.eu:25 -starttls smtp:

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 140 bytes and written 353 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

this is what i found in the logs (docker logs postal-smtp-1) so far:

2024-07-17 06:51:35 +0000 DEBUG  <= EHLO mail.example.com trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 DEBUG  => 250-My capabilities are trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 DEBUG  => 250-STARTTLS trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 DEBUG  => 250 AUTH CRAM-MD5 PLAIN LOGIN trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 DEBUG  <= STARTTLS trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 DEBUG  => 220 Ready to start TLS trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  An error occurred while processing data from a client. trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  Errno::ENOENT: No such file or directory @ rb_sysopen - config/smtp.crt trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:19:in `read' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:19:in `tls_certificates' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:63:in `ssl_context' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:226:in `block (2 levels) in run_event_loop' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:106:in `select' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:106:in `block in run_event_loop' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:104:in `loop' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:104:in `run_event_loop' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:39:in `block in run' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /usr/local/bundle/gems/klogger-logger-1.4.0/lib/klogger/group_set.rb:18:in `call_without_id' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /usr/local/bundle/gems/klogger-logger-1.4.0/lib/klogger/logger.rb:72:in `tagged' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  /opt/postal/app/app/lib/smtp_server/server.rb:37:in `run' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:35 +0000 ERROR  script/smtp_server.rb:13:in `<main>' trace_id=T5O3CJP1 component=smtp-server
2024-07-17 06:51:36 +0000 DEBUG  <= RSET trace_id=UQLPYQ62 component=smtp-server
2024-07-17 06:51:36 +0000 DEBUG  => 250 OK trace_id=UQLPYQ62 component=smtp-server
2024-07-17 06:51:40 +0000 DEBUG  <= AUTH LOGIN trace_id=UQLPYQ62 component=smtp-server
2024-07-17 06:51:40 +0000 DEBUG  => 334 VXNlcm5hbWU6 trace_id=UQLPYQ62 component=smtp-server

but after i corrected the the pathes in the /opt/postal/config/postal.yaml it worked correctly.

3 replies

plancked Oct 30, 2024

hi, what paths did you enter in postal.yaml?

I'm trying:

  tls_certificate_path: /config/smtp.crt
  tls_private_key_path: /config/smtp.key

or

  tls_certificate_path: config/smtp.crt
  tls_private_key_path: config/smtp.key

But it does not work:

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 141 bytes and written 354 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

rakurtz Oct 30, 2024

Hey plancked, i did as i wrote in my little tutorial (with a beginning "/".
Sorry not to be of more help

plancked Oct 30, 2024

so certificate files are in /opt/postal/config ?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Postal

ERROR: An error occurred while attempting to establish an SSL or TLS connection in Postal smtp #1458

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 14 comments 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

ERROR: An error occurred while attempting to establish an SSL or TLS connection in Postal smtp #1458

Replies: 14 comments · 3 replies

willpower232 Jul 20, 2021 Collaborator

winsta Jul 21, 2021 Author

winsta Jul 21, 2021 Author

CONNECTED(00000005) depth=0 C = GB, O = Default, OU = Default, CN = default verify error:num=18:self signed certificate verify return:1 depth=0 C = GB, O = Default, OU = Default, CN = default verify return:1

Certificate chain 0 s:C = GB, O = Default, OU = Default, CN = default i:C = GB, O = Default, OU = Default, CN = default

No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA Server Temp Key: DH, 1024 bits

SSL handshake has read 1791 bytes and written 553 bytes Verification error: self signed certificate

winsta Jul 21, 2021 Author

winsta Jul 21, 2021 Author

winsta Jul 21, 2021 Author

willpower232 Jul 22, 2021 Collaborator

Replies: 14 comments 3 replies

willpower232
Jul 20, 2021
Collaborator

winsta
Jul 21, 2021
Author

winsta
Jul 21, 2021
Author

CONNECTED(00000005)
depth=0 C = GB, O = Default, OU = Default, CN = default
verify error:num=18:self signed certificate
verify return:1
depth=0 C = GB, O = Default, OU = Default, CN = default
verify return:1

Certificate chain
0 s:C = GB, O = Default, OU = Default, CN = default
i:C = GB, O = Default, OU = Default, CN = default

No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: DH, 1024 bits

SSL handshake has read 1791 bytes and written 553 bytes
Verification error: self signed certificate

winsta
Jul 21, 2021
Author

winsta
Jul 21, 2021
Author

winsta
Jul 21, 2021
Author

willpower232
Jul 22, 2021
Collaborator