Solved TLS library problem in Mail

[richardtoohey2]

Other machine have both in the same version though.

I don't think this can be the case on FreeBSD 13.1 (but could be wrong!).

FreeBSD 12.4 had base OpenSSL upgraded to 1.1.1q:

https://www.freebsd.org/releases/12.4R/relnotes/

so maybe that's what you are looking at?

 

[Lamia]

FreeBSD 12.4 had base OpenSSL upgraded to 1.1.1q:

Thanks; but our systems are on 13.1-*.

 

[Lamia]

postconf | grep smtpd_tls_protocols

# postconf | grep smtpd_tls_protocols
smtpd_tls_protocols = >=TLSv1,<=TLSv1.3
tlsproxy_tls_protocols = $smtpd_tls_protocols

If you get an error for "no cipher match" then you can try to use the openssl from the base and rebuild all ports that you are using.

Done but no difference. Thanks for all you assistance.

 

[VladiBG]

Can you delete or comment smtpd_tls_protocols from your main config and reload the postfix service?

This is the third time that request to comment out this in post #11, #15, #18

 

[Lamia]

This is the third time that request to comment out this in post #11, #15, #18

Je regrette! I already responded to the request in #9, #14 and a few more. No difference -i.e. SSL write error persists - again and infact TLSv1.3, when added back then, made it possible to receive emails [Note: with the exception of emails from MS (outlook) servers]. I commented smtpd_tls_protocols out, made changes to it and many more. I later switched to the base OpenSSL as again requested but no luck. We are using different versions of OpenSSL, and having relied on the base version with no luck, I can only hope it will be fixed over - either via an upgrade like the XMPP/Prosody matter or any other means. One cannot rule out the possibility of a bug in one of the associated packages - Postfix, OpenSSL, etc. I use most recent versions of them.

Edit: added note

 

[Lamia]

perl -i.$SECONDS -wpl -e '/smtp[d_].*ls_exclude_ciphers/ and s/:ECDSA//g;' /usr/local/etc/postfix/main.cf

That's the fix. MS updated their cipher for mail delivery very recently.

I re-enabled DHPARAMS but won't help. I have left it in Postfix [used to work in Dovecot until an upgrade broke it] since it would only not be necessary in OPENSSLv3, which is not currently being used.

Thanks to everyone.

 

[Lamia]

smtp_tls_exclude_ciphers=aNULL:eNULL:LOW:3DES:MD5:MEDIUM:EXPSKSS:RC4:SEED:ECDSA:CAMELLIA256-SHA

One may leave it in the smtp_tls_exclude_ciphers though but not smtpd_tls_exclude_cipher. MS mail delivery will work. I however removed it for both in my case.