Hi,
I believe there are some folks from Deutsche Telekom on the list. Please have a
look into this:
We had some mails to addresses @magenta.de which were not delivered due to "Server certificate not verified" errors.
openssl s_client had no trouble connecting to the MX, so I was stumped. A colleague found the solution: DANE config for
magenta.de is invalid.
https://stats.dnssec-tools.org/explore/?magenta.de claims that there are no
matching TLSA records for magenta.de.
I'd love to see more explicit errors in the postfix log for this, even with
increased verbosity I only see
Oct 2 01:02:52 localhost postfix/smtp[2901865]: mx02.magenta.de[194.25.134.9]:25: depth=2 verify=1
subject=/C=DE/O=Deutsche Telekom Security GmbH/CN=Telekom Security TLS RSA Root 2023
Oct 2 01:02:52 localhost postfix/smtp[2901865]: mx02.magenta.de[194.25.134.9]:25: depth=1 verify=1
subject=/C=DE/O=Deutsche Telekom Security GmbH/organizationIdentifier=NTRDE-DER3201.HRB15241/CN=Telekom Security OV
RSA CA 26A
Oct 2 01:02:52 localhost postfix/smtp[2901865]: mx02.magenta.de[194.25.134.9]:25: depth=0 verify=1
subject=/C=DE/ST=Nordrhein-Westfalen/L=Bonn/O=Deutsche Telekom AG/CN=mx.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]: SSL_connect:SSLv3/TLS read
server certificate
Oct 2 01:02:52 localhost postfix/smtp[2901865]: SSL_connect:TLSv1.3 read
server certificate verify
Oct 2 01:02:52 localhost postfix/smtp[2901865]: SSL_connect:SSLv3/TLS read
finished
Oct 2 01:02:52 localhost postfix/smtp[2901865]: SSL_connect:SSLv3/TLS write
finished
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx00.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx01.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx02.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx03.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx.magenta.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx00.magenta.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx01.magenta.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx02.magenta.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25: subjectAltName: mx03.magenta.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]:
mx02.magenta.de[194.25.134.9]:25 CommonName mx.t-online.de
Oct 2 01:02:52 localhost postfix/smtp[2901865]: mx02.magenta.de[194.25.134.9]:25: subject_CN=mx.t-online.de,
issuer_CN=Telekom Security OV RSA CA 26A, fingerprint=E1:8C:51:E6:6D:EE:97:63:87:83:52:A3:B4:D7:D0:54,
pkey_fingerprint=C0:DB:DA:CA:D5:2D:53:C8:AB:E9:9A:33:37:03:C8:75
Oct 2 01:02:52 localhost postfix/smtp[2901865]: Trusted TLS connection established to
mx02.magenta.de[194.25.134.9]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384)
server-signature RSA-PSS (4096 bits) server-digest SHA256
Oct 2 01:02:52 localhost postfix/smtp[2901865]: BD92A1207A1: to=<*@magenta.de>,
relay=mx02.magenta.de[194.25.134.9]:25, delay=32456, delays=32455/0.04/0.27/0, dsn=4.7.5, status=deferred (Server
certificate not verified)
which does not really indicate to me that there is a DANE problem. Apparently if you search for postfix and "Server
certificate not verified" you will get pointers to DANE issues, but yesterday I was a little too tired to do that search
(and I steadfastly refuse to use LLMs for various reasons).
Cheers,
Hans-Martin
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
