Re: disturbing TLS error

2013-09-15 Thread James Cloos
The mx lookup on effraie.org returns mx.effraie.org. The cert mx.effraie.org sends has a number of dnsnames, but not mx.effraie.org. I bet that is why the session failed. The mx for 400iso.net, mx.400iso.net, sends the same cert and also likely will fail tls negotiation with some senders. In

Re: disturbing TLS error

2013-09-15 Thread Viktor Dukhovni
On Sun, Sep 15, 2013 at 03:31:38PM -0400, James Cloos wrote: The mx lookup on effraie.org returns mx.effraie.org. The cert mx.effraie.org sends has a number of dnsnames, but not mx.effraie.org. I bet that is why the session failed. I noticed this, but I thought it unlikely that a sender

Re: disturbing TLS error

2013-09-15 Thread Mathieu R.
James Cloos cl...@jhcloos.com a écrit : The mx lookup on effraie.org returns mx.effraie.org. The cert mx.effraie.org sends has a number of dnsnames, but not mx.effraie.org. I bet that is why the session failed. The mx for 400iso.net, mx.400iso.net, sends the same cert and also likely will fail

Re: disturbing TLS error

2013-09-15 Thread Wietse Venema
Mathieu R.: As it seem to be a good advice, I did change my dns entries for mx to mail.effraie.org, wich is covered by the (new) cacert certificat of the mail server. I still have the same error in logs It does not matter what the server certificate says, because it is never sent. The

Re: disturbing TLS error

2013-09-15 Thread John Allen
I ran into a problem that seems to have some of the same attributes. In my case Google was rejecting my email, however they may have been a little more polite about doing so. Have you checked your DNS and reverse DNS entries. Is your server a dedicated system with a single IP address. In my

Re: disturbing TLS error

2013-09-14 Thread Mathieu R.
Le 14/09/2013 03:23, Viktor Dukhovni a écrit : On Fri, Sep 13, 2013 at 11:51:39PM +0200, Mathieu R. wrote: not very much more : Sep 13 23:33:09 effraie01 postfix/smtpd[25221]: connect from ng4.bullet.mail.bf1.yahoo.com[98.139.164.99] Sep 13 23:33:44 effraie01 postfix/smtpd[25221]: SSL_accept

Re: disturbing TLS error

2013-09-14 Thread Jan P. Kessler
So, there is nothing i can do ? If you don't need TLS for yahoo you can disable it for that server. Take a look at http://www.postfix.org/postconf.5.html#smtpd_discard_ehlo_keyword_address_maps

Re: disturbing TLS error

2013-09-14 Thread Viktor Dukhovni
On Sat, Sep 14, 2013 at 08:45:05AM +0200, Mathieu R. wrote: Yahoo sends STARTTLS, Postfix says go ahead and Yahoo disconnects. There's is nothing more to it. Some strange problem on the Yahoo side, unless your firewall is blocking the handshake. My firewall is not doing such rude things.

disturbing TLS error

2013-09-13 Thread Mathieu R.
Hello, i've just setted up a postfix server, and i constantly have such error in my logs : Sep 13 21:31:34 effraie01 postfix/smtpd[12650]: SSL_accept error from ng17.bullet.mail.bf1.yahoo.com (ever from yahoo servers) i can't figure out wher my mistake come from. here is my postconf -n :

Re: disturbing TLS error

2013-09-13 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 09:44:38PM +0200, Mathieu R. wrote: Sep 13 21:31:34 effraie01 postfix/smtpd[12650]: SSL_accept error from ng17.bullet.mail.bf1.yahoo.com There is generally more information in the log than this when the TLS handshake fails. DO NOT over-summarize the logs. (ever from

Re: disturbing TLS error

2013-09-13 Thread Mathieu R.
Le 13/09/2013 22:29, Viktor Dukhovni a écrit : On Fri, Sep 13, 2013 at 09:44:38PM +0200, Mathieu R. wrote: Sep 13 21:31:34 effraie01 postfix/smtpd[12650]: SSL_accept error from ng17.bullet.mail.bf1.yahoo.com There is generally more information in the log than this when the TLS handshake

Re: disturbing TLS error

2013-09-13 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 11:03:22PM +0200, Mathieu R. wrote: There is generally more information in the log than this when the TLS handshake fails. DO NOT over-summarize the logs. Sep 13 22:58:40 effraie01 postfix/smtpd[22230]: SSL_accept error from

Re: disturbing TLS error

2013-09-13 Thread Mathieu R.
Le 13/09/2013 23:26, Viktor Dukhovni a écrit : On Fri, Sep 13, 2013 at 11:03:22PM +0200, Mathieu R. wrote: There is generally more information in the log than this when the TLS handshake fails. DO NOT over-summarize the logs. Sep 13 22:58:40 effraie01 postfix/smtpd[22230]: SSL_accept error

Re: disturbing TLS error

2013-09-13 Thread DTNX Postmaster
On Sep 13, 2013, at 23:51, Mathieu R. math...@400iso.net wrote: Le 13/09/2013 23:26, Viktor Dukhovni a écrit : If your traffic volume is not too heavy, you can temporarily raise the Postfix SMTP server TLS log level to 2: smtpd_tls_loglevel = 2 this will show more details of the TLS

Re: disturbing TLS error

2013-09-13 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 11:51:39PM +0200, Mathieu R. wrote: not very much more : Sep 13 23:33:09 effraie01 postfix/smtpd[25221]: connect from ng4.bullet.mail.bf1.yahoo.com[98.139.164.99] Sep 13 23:33:44 effraie01 postfix/smtpd[25221]: SSL_accept error from