I’m trying to debug this for days, but I’m stuck, so I’m asking for help:
I’m running my own mail server (Postfix) with TLS enabled and Let’s encrypt certificates (using the ACME setting in Nginx).
It worked perfectly with 19.09 and recently, after upgrading the whole system to 20.03, this configuration does not accept TLS connections from hosts like outlook.com.
Which means that my users (family) who expect mail from outlook.com users do not get the mail at all (also fallback to non-TLS is not executed… by outlook.com?).
In other words: mail is lost - no retries later (and the original sender apparently do not receive bounce mails).
Log file when outlook.com tries to deliver an e-mail:
May 13 21:31:00 server postfix/smtpd[24537]: connect from mail-eopbgr60060.outbound.protection.outlook.com[40.107.6.60]
May 13 21:31:00 server postfix/smtpd[24537]: setting up TLS connection from mail-eopbgr60060.outbound.protection.outlook.com[40.107.6.60]
May 13 21:31:00 server postfix/smtpd[24537]: mail-eopbgr60060.outbound.protection.outlook.com[40.107.6.60]: TLS cipher list "aNULL:-aNULL:HIGH:MEDIUM:+RC4:
@STRENGTH"
May 13 21:31:00 server postfix/smtpd[24537]: SSL_accept:before SSL initialization
May 13 21:31:00 server postfix/smtpd[24537]: read from 55DBCFD5ADD0 [55DBCFD5F533] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))
May 13 21:31:00 server postfix/smtpd[24537]: read from 55DBCFD5ADD0 [55DBCFD5F533] (5 bytes => 5 (0x5))
May 13 21:31:00 server postfix/smtpd[24537]: 0000 16 03 03 00 a0 .....
May 13 21:31:00 server postfix/smtpd[24537]: read from 55DBCFD5ADD0 [55DBCFD5F538] (160 bytes => 160 (0xA0))
May 13 21:31:00 server postfix/smtpd[24537]: 0000 01 00 00 9c 03 03 5e bc|4a f4 5b 53 1d b4 21 1a ......^. J.[S..!.
(some lines skipped...)
May 13 21:31:00 server postfix/smtpd[24537]: 0090 01 06 03 00 23 00 00 00|17 00 00 ff 01 00 01 ....#... .......
May 13 21:31:00 server postfix/smtpd[24537]: 009f - <SPACES/NULLS>
May 13 21:31:00 server postfix/smtpd[24537]: SSL_accept:before SSL initialization
May 13 21:31:00 server postfix/smtpd[24537]: write to 55DBCFD5ADD0 [55DBCFD566D0] (7 bytes => 7 (0x7))
May 13 21:31:00 server postfix/smtpd[24537]: 0000 15 03 03 00 02 02 28 ......(
May 13 21:31:00 server postfix/smtpd[24537]: SSL3 alert write:fatal:handshake failure
May 13 21:31:00 server postfix/smtpd[24537]: SSL_accept:error in error
May 13 21:31:00 server postfix/smtpd[24537]: SSL_accept error from mail-eopbgr60060.outbound.protection.outlook.com[40.107.6.60]: -1
May 13 21:31:00 server postfix/smtpd[24537]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:ssl/s
tatem/statem_srvr.c:2282:
May 13 21:31:00 server postfix/smtpd[24537]: lost connection after STARTTLS from mail-eopbgr60060.outbound.protection.outlook.com[40.107.6.60]
May 13 21:31:00 server postfix/smtpd[24537]: disconnect from mail-eopbgr60060.outbound.protection.outlook.com[40.107.6.60] ehlo=1 starttls=0/1 commands=1/2
The problem is not the cipher list “aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH”, because here is another server trying to deliver some spam mail, with the same cipher list:
May 13 21:43:31 server postfix/smtpd[25799]: connect from uspmta194148.emarsys.net[217.175.194.148]
May 13 21:43:32 server postfix/smtpd[25799]: setting up TLS connection from uspmta194148.emarsys.net[217.175.194.148]
May 13 21:43:32 server postfix/smtpd[25799]: uspmta194148.emarsys.net[217.175.194.148]: TLS cipher list "aNULL:-aNULL:HIGH:
MEDIUM:+RC4:@STRENGTH"
May 13 21:43:32 server postfix/smtpd[25799]: SSL_accept:before SSL initialization
lot's of lines skipped
May 13 21:43:32 server postfix/smtpd[25799]: SSL_accept:SSLv3/TLS write finished
May 13 21:43:32 server postfix/smtpd[25799]: Anonymous TLS connection established from uspmta194148.emarsys.net[217.175.194
.148]: TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)
The configuration is not special at all, here is the most important part (which has NOT changed - so it worked flawlessly in 19.09):
services.postfix = {
enable = true;
domain = "kvtb-personal-domain.com";
origin = "$mydomain";
destination =
[ "$myhostname" "localhost.$mydomain" "localhost" "$mydomain" ];
networksStyle = "host";
relayHost = relayHost;
rootAlias = "kvtb";
extraAliases = "MAILER-DAEMON: postmaster";
sslCert = sslCert;
sslKey = sslKey;
};
where sslCert refers to the path of the ACME generated fullchain.pem, sslKey refers to the path of the key.pem file.
My own conclusions this far:
- Online TLS tests show my setup is flawless, but outlook.com (and some other servers) doesn’t accept it anymore. However most servers have no problem delivering mail via TLS.
- Since the issue already happens when trying to setup the TLS connection, I don’t think it is a Postfix problem.
- So it could be that outlook.com doesn’t like Let’s encrypt certificates,
- or something is wrong with openssl? What has changed between 19.09 and 20.03? And what should I do now?