5

My exim server is showing the following error: TLS error on connection from xxxx.xxxx.xxxx. ([127.0.0.1]) [xxx.xxx.xxx.xxx] (gnutls_handshake): A TLS fatal alert has been received.

I'm using the plain authentication and my settings are :

plain_server:
  driver = plaintext
  public_name = PLAIN
  server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  server_set_id = $auth2
  server_prompts = :
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
     server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

Looking forward to any help or pointers

thanks in advance

zero0
  • 1,407
  • 16
  • 14
John Mathew
  • 51
  • 1
  • 1
  • 3

2 Answers2

7

If you are running an exim installation, the reason was GnuTLS here. Solution found at http://blog.josefsson.org/2009/04/16/cacert-and-gnutls/.

Type following commands

  1. apt-get install gnutls-bin to have gnutls-cli available.
  2. gnutls-cli -s -p 25 YOURSMTPHOST (starts a session with your mailserver)
  3. ehlo foo
  4. starttls
  5. Press CTRL+d (^d)

Then you see something like

- The hostname in the certificate does NOT match 'example.org'

Then the subject of your certificate does not match your server YOURSMTPHOST. In my case, I connected to flupp.de, but the CN of the certificate was *.flupp.de. I changed flupp.de to mail.flupp.de and everyhting worked fine again.

koppor
  • 201
  • 5
  • 11
  • My certificate was for smtp.domain, but my MX record and the HELO indicated host.domain. However, after addressing that, I still receive this error in the logs. @koppor – Boyd Stephen Smith Jr. Feb 07 '15 at 22:05
  • This might not have helped the original poster, but it did help me. The difference I suppose, is that I'm trying to test STARTTLS on a test server, using the live server's SSL cert. And, well, that just won't work until the test server becomes the live server. – Ernie May 20 '15 at 18:05
  • 1
    the commands listed were perfect to verify that this was my problem too, which I suspected. excellent answer! – simpleuser Sep 25 '15 at 23:31
1

Let me guess: you've compiled against GnuTLS, the mailserver you're talking to is GMX.de or web.de, and the problem started a few weeks ago? Both these providers turned on TLS in response to the NSA issue, but they didn't quite get it right.

As a workaround, you can compile exim against OpenSSL which is more tolerant, but do note that the problem is with GMX and web.de.

Nikratio
  • 635
  • 5
  • 13