Topic: [SOLVED] Mail rejected due to SSLv2 cipher?

[CharlieBrady]

If I instruct openssl s_client to use TLS1 for starttls, then the connection succeeds:

Code: [Select]

-bash-3.2$ openssl s_client -starttls smtp -crlf -tls1 -connect smialcott.com:25
CONNECTED(00000003)
depth=3 /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
verify return:1
depth=2 /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
verify return:1
...

If I tcpdump sniff the connection, I can see that the failing connection uses an SSLv2 packet to contain the "Client Hello", whereas with -tls1 the "Client Hello" is contained in a TLSv1 packet. So the symptoms are consistent with SSLv2 connections don't succeed where TLSv1 connections do. Which is exactly what you want to be happening I believe.

However, I think the risk of Poodle to you is low, and you are quite inconvenienced by not receiving email from united airlines. So I would 1) complain to United Airlines, and 2) re-enable SSLv2. Or, if you can work out how to do it, create an exception for United's mail server IP addresses.

[smiit]

Thank you both for the follow-up testing and diagnostics.  Much appreciated.

I added the +SSL2v2 cipher to this file:

/var/service/qpsmtpd/control/tlsserverciphers

per Charlie's suggestion from here: http://www.qmailwiki.org/Qmail-control-files#control.2Ftlsserverciphers

Then ran:

Code: [Select]

db configuration setprop qpsmtpd tlsCipher 'ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM'
signal-event email-update

Are you able to get a successful SSLv2 Hello?

[CharlieBrady]

per Charlie's suggestion from here: http://www.qmailwiki.org/Qmail-control-files#control.2Ftlsserverciphers

My suggestion was for what the *sender* should do to fix the problem, since they seem to be using a patched qmail distribution which was doing starttls encryption outbound.

In any case, configuring the cipher set doesn't do anything to the SSL protocol version which is used.

[smiit]

Editing Subject to [SOLVED] ..

qpsmtpd update this morning resolved the incoming mail problem:

http://forums.contribs.org/index.php/topic,51505.msg261791.html#msg261791

Thanks to Charlie, DanB35 and everyone who helped, directly & indirectly.