Because that's the way the programmer wrote it. ;)
Seriously though, would you really want it to? In most circumstances I
would think not.
BL is, the destination server shouldn't be advertising STARTTLS if it
can't handle it properly.
jim jackson wrote:
When tls fails why doesn't my qmt choose another method of delivery?
On Thu, Feb 25, 2010 at 6:23 PM, jim jackson <[email protected]
<mailto:[email protected]>> wrote:
Hey guys,
Any ideas on how I should configure my qmt to deal with this kind of
problem? I ran both the swaks and openssl tool and verified that the
problem is with the remote server and not mine.
./swaks --protocol ESMTPS --to [email protected]
<mailto:[email protected]> --from [email protected]
<mailto:[email protected]>
=== Trying mail.domain.ca:25...
=== Connected to mail.domain.ca <http://mail.domain.ca>.
<- 220 mail.domain.ca <http://mail.domain.ca> Microsoft ESMTP MAIL
Service, Version: 5.0.2195.6713 ready at Thu, 25 Feb 2010 17:04:32
-0800
-> EHLO mail.domain.com <http://mail.domain.com>
<- 250-mail.domain.ca <http://250-mail.domain.ca> Hello [192.168.0.254]
<- 250-TURN
<- 250-ATRN
<- 250-SIZE
<- 250-ETRN
<- 250-PIPELINING
<- 250-DSN
<- 250-ENHANCEDSTATUSCODES
<- 250-8bitmime
<- 250-BINARYMIME
<- 250-CHUNKING
<- 250-VRFY
<- 250-TLS
<- 250-STARTTLS
<- 250-X-EXPS GSSAPI NTLM LOGIN
<- 250-X-EXPS=LOGIN
<- 250-AUTH GSSAPI NTLM LOGIN
<- 250-AUTH=LOGIN
<- 250-X-LINK2STATE
<- 250-XEXCH50
<- 250 OK
-> STARTTLS
<- 220 2.0.0 SMTP server ready
*** TLS startup failed (error:00000000:lib(0):func(0):reason(0))
*** STARTTLS attempted but failed
-> QUIT
openssl s_client -starttls smtp -crlf -debug -connect
mail.domain.ca:25 <http://mail.domain.ca:25>
depth=0
/C=CA/ST=BC/L=Vancouver/O=domain/OU=Exchange/CN=PC/[email protected]
<mailto:[email protected]>
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0
/C=CA/ST=BC/L=Vancouver/O=domain/OU=Exchange/CN=PC/[email protected]
<mailto:[email protected]>
verify error:num=27:certificate not trusted
verify return:1
depth=0
/C=CA/ST=BC/L=Vancouver/O=domain/OU=Exchange/CN=PC/[email protected]
<mailto:[email protected]>
verify error:num=21:unable to verify the first certificate
verify return:1
write to 0x109cb080 [0x109dc610] (75 bytes => 75 (0x4B))
0000 - 16 03 01 00 46 10 00 00-42 00 40 86 91 60 c6 2f
....f.....@..`./
0010 - f0 84 6a 33 0f 28 12 b4-c7 95 0f 17 25 5b 8a ac
..j3.(......%[..
0020 - 5b 5a ff 1b b6 87 2f 66-ee 44 e6 5a f7 14 6f bc
[Z..../f.D.Z..o.
0030 - bf b7 88 b9 73 ca 52 76-43 f6 9e 7b 66 4f 13 d6
....s.RvC..{fO..
0040 - 14 e6 a4 0d ab 3b 83 bf-b4 4c 03 .....;...L.
write to 0x109cb080 [0x109dc610] (6 bytes => 6 (0x6))
0000 - 14 03 01 00 01 01 ......
write to 0x109cb080 [0x109dc610] (37 bytes => 37 (0x25))
0000 - 16 03 01 00 20 11 2e 1f-cd 99 a7 15 f7 f9 86 95 ....
...........
0010 - b6 8f 42 e9 f1 e0 f3 26-43 32 b0 65 7f 03 2f ea
..B....&C2.e../.
0020 - 63 e7 d2 3f d2 c..?.
read from 0x109cb080 [0x109d19b0] (5 bytes => 0 (0x0))
4665:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake
failure:s23_lib.c:188:
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
