orangeCatDeveloper opened a new pull request, #4327: URL: https://github.com/apache/hertzbeat/pull/4327
Fixes #4323 Users with an internal SMTP server — self-signed cert, or reached by IP with no matching SAN — cannot use email notification at all: the TLS handshake fails and there is no way to opt out. Java runs two independent checks on the server certificate: (1) is the chain signed by a trusted CA, and (2) does the cert name (CN/SAN) match the address dialed. Either one failing kills the connection, and internal mail servers commonly fail both. The fix adds a "Verify SSL Certificate" toggle to the email server config, default **on** so existing setups are unaffected. Switching it off sets `mail.smtp.ssl.trust=*` (skips check 1) and `mail.smtp.ssl.checkserveridentity=false` (skips check 2, the exact failure quoted in the issue — Angus Mail defaults it to true). `JavaMailSenderImpl` is a singleton, so turning verification back on removes both properties instead of leaving them stale; `EmailAlertNotifyHandlerImplTest` pins both directions. Boundary: the yml fallback path always verifies — anyone who previously hand-configured `mail.smtp.ssl.trust` in application.yml should switch to the UI toggle. Before / after (real JavaMail handshake against a local self-signed SMTPS server; the before error matches the issue verbatim): ``` before (verify on, default): [Email Notify Error] Mail server connection failed. Failed messages: jakarta.mail.MessagingException: Could not connect to SMTP host: 127.0.0.1, port: 62415; nested exception is: javax.net.ssl.SSLHandshakeException: (certificate_unknown) No subject alternative names matching IP address 127.0.0.1 found after (verify off): mail sent successfully through the self-signed TLS server ``` UI — the toggle renders only when SSL or STARTTLS is enabled: -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
