Jump to content
Froxlor Forum
  • 0

Nach neuem LE Cert Probleme mit Postfix "tls_post_process_client_hello:no shared cipher"

rincewind0803

Asked by rincewind0803,

 Share

Question

rincewind0803 Apprentice

rincewind0803

Posted
Posted

Hallo zusammen,

 

Ich grüble hier seit ein paar tagen über ein Problem im Postfix.

Ich habe eine seit 2-3 Jahren fehlerfrei laufende Froxlor Installation und plötzlich kann ein bestimmter absendender Mailserver keine Mails mehr an mich verschicken.
Postfix Log sagt: 

 warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher

Ich hatte zuerst den Cron im Verdacht, da gab es mal das Problem dass er das Cert für den Froxlor selber nicht erneuerte(ich nutze das auch für Postfox/dovecot), aber das Cert wurde automatisch am 09.03. 23:45 erneuert.

Ich bekomme von diesem Mailserver regelmäßig Mails, interessanterweise keine mehr nach der Zertifikatserneuerung.

An der Config Froxlor/LetsEncrypt/Postfix wurde nichts verändert in diesem Zeitraum.

Weiss jemand ob sich in der lezten Zeit etwas in der Art wie Froxlor die Zertifikate erneuert etwas verändert hat ? Oder gab es in den letzten Monaten Änderungen bei Letsencrypt ? 
Ist das vielleicht nur Zufall und ich muss ganz woanders gucken ?

 

Bin für jeden Hinweis Dankbar.

 

Link to comment
Share on other sites

14 answers to this question

Recommended Posts

  • 0
rincewind0803 Apprentice

rincewind0803

Posted
  • Author
Posted

Es läuft Postfix 3.5.25 auf einem Debian 11.

Hier die Angaben zu den Ciphers 

root@mail:~# postconf -d | grep cipher                                                                                                                           
lmtp_tls_ciphers = medium                                                                                                                                        
lmtp_tls_exclude_ciphers =                                                                                                                                       
lmtp_tls_mandatory_ciphers = medium                                                                                                                              
lmtp_tls_mandatory_exclude_ciphers =                                                                                                                             
milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer}                                                                           
smtp_tls_ciphers = medium                                                                                                                                        
smtp_tls_exclude_ciphers =                                                                                                                                       
smtp_tls_mandatory_ciphers = medium                                                                                                                              
smtp_tls_mandatory_exclude_ciphers =                                                                                                                             
smtpd_tls_ciphers = medium                                                                                                                                       
smtpd_tls_exclude_ciphers =                                                                                                                                      
smtpd_tls_mandatory_ciphers = medium                                                                                                                             
smtpd_tls_mandatory_exclude_ciphers =                                                                                                                            
tls_export_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:EXPORT:+RC4:@STRENGTH                                                                                       
tls_high_cipherlist = aNULL:-aNULL:HIGH:@STRENGTH                                                                                                                
tls_low_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:+RC4:@STRENGTH                                                                                                 
tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH                                                                                                  
tls_null_cipherlist = eNULL:!aNULL                                                                                                                               
tls_preempt_cipherlist = no                                                                                                                                      
tls_session_ticket_cipher = aes-256-cbc                                                                                                                          
tlsproxy_tls_ciphers = $smtpd_tls_ciphers                                                                                                                        
tlsproxy_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers                                                                                                        
tlsproxy_tls_mandatory_ciphers = $smtpd_tls_mandatory_ciphers                                                                                                    
tlsproxy_tls_mandatory_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers

 

 

Link to comment
Share on other sites
  • 0
d00p Grand Master

d00p

Posted
Posted

Habe ich auf den meisten systemen ziemlich auch so, würde schätzen das hier ggfls ein veralteter (anderer) server oder eben client keine ausreichend modernen cipher unterstützt, um eine korrekte kommunikation herstellen zu können, da bräuchte man jetzt etwas mehr kontext aus den logs als nur die eine zeile

Link to comment
Share on other sites
  • 0
rincewind0803 Apprentice

rincewind0803

Posted
  • Author
Posted

So sah eine mailzustellung bis vor kurzem aus(leider nur loglevel1): 

Feb 26 10:20:40 mail postfix/smtpd[27702]: D7BABC00B2: client=IPMAIL1.FremderMailserver.de[fre.mde.ip.adr]
Feb 26 10:20:40 mail postfix/cleanup[27710]: D7BABC00B2: message-id=<197633.32352.240226102034.000000196@absen.der>
Feb 26 10:20:40 mail opendkim[549]: D7BABC00B2: IPMAIL1.FremderMailserver.de [fre.mde.ip.adr] not internal
Feb 26 10:20:40 mail opendkim[549]: D7BABC00B2: not authenticated
Feb 26 10:20:40 mail postfix/qmgr[898]: D7BABC00B2: from=<noreply@absen.der>, size=5280, nrcpt=1 (queue active)
Feb 26 10:20:44 mail postfix/pickup[27079]: C67DDC0429: uid=2002 from=<noreply@absen.der>
Feb 26 10:20:44 mail postfix/pipe[27712]: D7BABC00B2: to=<meine@email.de>, relay=spamassassin, delay=10, delays=6.2/0/0/3.9,
 dsn=2.0.0, status=sent (delivered via spamassassin service)
Feb 26 10:20:44 mail postfix/qmgr[898]: D7BABC00B2: removed
Feb 26 10:20:44 mail postfix/cleanup[27710]: C67DDC0429: message-id=<197633.32352.240226102034.000000196@absen.der>
Feb 26 10:20:44 mail opendkim[549]: C67DDC0429: no signing table match for 'noreply@absen.der'
Feb 26 10:20:44 mail postfix/qmgr[898]: C67DDC0429: from=<noreply@absen.der>, size=5677, nrcpt=1 (queue active)
Feb 26 10:20:44 mail dovecot: lda(meine@email.de)<27717><1PdWMuxX3GVFbAAAgFDlXQ>: msgid=<197633.32352.240226102034.000000196
@absen.der>: saved mail to INBOX

und das ist die aktuelle version: 

Mar 15 14:54:51 mail postfix/smtpd[526021]: initializing the server-side TLS engine
Mar 15 14:54:51 mail postfix/smtpd[526021]: connect from IPMAIL2.FremderMailserver.de[fre.mde.ip.adr]
Mar 15 14:54:52 mail postfix/smtpd[526021]: setting up TLS connection from IPMAIL2.FremderMailserver.de[fre.mde.ip.adr]
Mar 15 14:54:52 mail postfix/smtpd[526021]: IPMAIL2.FremderMailserver.de[fre.mde.ip.adr]: TLS cipher list "aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH"
Mar 15 14:54:52 mail postfix/smtpd[526021]: SSL_accept:before SSL initialization
Mar 15 14:54:52 mail postfix/smtpd[526021]: read from 5575CD4F68E0 [5575CD4FD273] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Mar 15 14:54:52 mail postfix/smtpd[526021]: read from 5575CD4F68E0 [5575CD4FD273] (5 bytes => 5 (0x5))
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0000 16 03 01 00 b3                                   .....
Mar 15 14:54:52 mail postfix/smtpd[526021]: read from 5575CD4F68E0 [5575CD4FD278] (179 bytes => 179 (0xB3))
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0000 01 00 00 af 03 03 3e c5|66 00 b8 40 36 fc 88 6b  ......>. f..@6..k
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0010 8f c1 02 68 b3 96 35 9c|87 14 6f 1f 52 a3 fe f3  ...h..5. ..o.R...
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0020 e7 b0 0c cf 71 a1 00 00|36 c0 2c c0 30 c0 2b c0  ....q... 6.,.0.+.
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0030 2f 00 9f 00 9e cc a9 cc|a8 c0 24 c0 28 c0 23 c0  /....... ..$.(.#.
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0040 27 cc aa 00 6b 00 67 c0|09 c0 13 00 33 00 9d c0  '...k.g. ....3...
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0050 9d 00 9c c0 9c 00 3d 00|3c 00 35 00 2f 00 ff 01  ......=. <.5./...
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0060 00 00 50 00 0b 00 04 03|00 01 02 00 0a 00 04 00  ..P..... ........
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0070 02 00 17 00 23 00 00 00|16 00 00 00 17 00 00 00  ....#... ........
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0080 0d 00 30 00 2e 04 03 05|03 06 03 08 07 08 08 08  ..0..... ........
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0090 09 08 0a 08 0b 08 04 08|05 08 06 04 01 05 01 06  ........ ........
Mar 15 14:54:52 mail postfix/smtpd[526021]: 00a0 01 03 03 02 03 03 01 02|01 03 02 02 02 04 02 05  ........ ........
Mar 15 14:54:52 mail postfix/smtpd[526021]: 00b0 02 06 02                                         ...
Mar 15 14:54:52 mail postfix/smtpd[526021]: SSL_accept:before SSL initialization
Mar 15 14:54:52 mail postfix/smtpd[526021]: write to 5575CD4F68E0 [5575CD506450] (7 bytes => 7 (0x7))
Mar 15 14:54:52 mail postfix/smtpd[526021]: 0000 15 03 03 00 02 02 28                             ......(
Mar 15 14:54:52 mail postfix/smtpd[526021]: SSL3 alert write:fatal:handshake failure
Mar 15 14:54:52 mail postfix/smtpd[526021]: SSL_accept:error in error
Mar 15 14:54:52 mail postfix/smtpd[526021]: SSL_accept error from IPMAIL2.FremderMailserver.de[fre.mde.ip.adr]: -1
Mar 15 14:54:52 mail postfix/smtpd[526021]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2283:
Mar 15 14:54:52 mail postfix/smtpd[526021]: lost connection after STARTTLS from IPMAIL2.FremderMailserver.de[fre.mde.ip.adr]
Mar 15 14:54:52 mail postfix/smtpd[526021]: disconnect from IPMAIL2.FremderMailserver.de[fre.mde.ip.adr] ehlo=1 starttls=0/1 commands=1/2

 

Link to comment
Share on other sites
  • 0
d00p Grand Master

d00p

Posted
Posted

Und du kannst ja auch von außen mal testen, ob ssl verbindungen zu dir problemlos funktionieren: 

openssl s_client -starttls smtp -crlf -connect fqdn:587

 

Link to comment
Share on other sites
  • 0
Shortie Enthusiast

Shortie

Posted
Posted
7 hours ago, d00p said:

Und du kannst ja auch von außen mal testen, ob ssl verbindungen zu dir problemlos funktionieren: 

openssl s_client -starttls smtp -crlf -connect fqdn:587

 

Wäre Port 25 nicht besser? Mailserver untereinander unterhalten sich ja eher nicht über Submission (Port 587)

Link to comment
Share on other sites
  • 0
rincewind0803 Apprentice

rincewind0803

Posted
  • Author
Posted

Ich habe ja nichts verändert, mail Empfang läuft ja nach wie vor, bis auf mittlerweile 2 Firmen die plötzlich keine mail mehr an mich verschicken können.

23 hours ago, d00p said:

 

Welche protokolle sind denn aktiv? 

postconf | grep smtpd_tls_protocols

 

root@mail:~# postconf | grep smtpd_tls_protocols
smtpd_tls_protocols = !SSLv2, !SSLv3
tlsproxy_tls_protocols = $smtpd_tls_protocols

 

 

14 hours ago, d00p said:

Probier doch einfach alle? 25, 587, 465... 

marcus@marcus-desktop:~$ openssl s_client -starttls smtp -crlf -connect mein-server.de:587
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = mail.mein-server.de
verify return:1
---
Certificate chain
 0 s:CN = mail.mein-server.de
   i:C = US, O = Let's Encrypt, CN = R3
   a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar  9 22:02:11 2024 GMT; NotAfter: Jun  7 22:02:10 2024 GMT
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEaTCCA1GgAwIBAgISBEnvZDItomrNNZQs+zuNr/J0MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yNDAzMDkyMjAyMTFaFw0yNDA2MDcyMjAyMTBaMCExHzAdBgNVBAMT
Fm1haWwuYW53YWx0LWNhc3Ryb3AuZGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATi
XdjyHLJCGbTn0Kt8tSl7DCdkjFp6C8t8xxuy9FzgkQG8GCfSnGyGikY+vNLM3hY5
v3ZQeprTqlb8+QvogHbWKHvu0Bwn4AiFxCYIr9Hx11qQ/Y25sH4X7xjf5FujCc2j
ggI2MIICMjAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFMYRNbOt1P1WPAD6a22eqjKr
5qu2MB8GA1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEB
BEkwRzAhBggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUF
BzAChhZodHRwOi8vcjMuaS5sZW5jci5vcmcvMD0GA1UdEQQ2MDSCFm1haWwuYW53
YWx0LWNhc3Ryb3AuZGWCGnd3dy5tYWlsLmFud2FsdC1jYXN0cm9wLmRlMBMGA1Ud
IAQMMAowCAYGZ4EMAQIBMIIBBgYKKwYBBAHWeQIEAgSB9wSB9ADyAHcAO1N3dT4t
uYBOizBbBv5AO2fYT8P0x70ADS1yb+H61BcAAAGOJXPV0QAABAMASDBGAiEA8NTr
nGsJzlH+SJ4/gbC+Z6lqXMqwU4qJMTBrVPHFH5ICIQCzKzY1A2DzzFwa1J2ca/7A
l6cqo4eUwUVMncK+0AKF6wB3AO7N0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZx
H7WbAAABjiVz1dgAAAQDAEgwRgIhAIw+BcyCG7nz3VcZospnlyrrJ5IBQGV6SS2l
CaEUUaT0AiEAoxfb+6rHUAAGHtzF6+pvx05FfDc4jnbl7Vhttg45OrAwDQYJKoZI
hvcNAQELBQADggEBAIW/TZwCvWFpyswjcZMg1Pd9ZmEnvd4OJvtS+7ssWJ135k4f
gXof9didIU+BeZ7mCuVd3weeICBgZ6N1y0NV7mCkbipUTHh6Oq8+Ge9eCJCWihN1
W6oTBDsZlUjRxZSblqHOdgIKjLA7iuHwphyA2cOxa3vO+YZPHGqqVw47nlJNj+PP
HDS9UPeAlISmly7gVKtDDSntB6/FBK3YmYftsz5D4mgj8xoOkkaQ3v0i3jEkKq7l
7qSEeobxTLY1y9vJ0DOEtBaPoMdXuaYPix1B4QcWmytrqssoKMqV4lY0AJp96ukC
OxtE3hYT8gUnbUKSL+jxtnCBVfnHKBFisW+dN5s=
-----END CERTIFICATE-----
subject=CN = mail.mein-server.de
issuer=C = US, O = Let's Encrypt, CN = R3
---
No client certificate CA names sent
Peer signing digest: SHA384
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3068 bytes and written 432 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 384 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
250 DSN
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 88AFD7EC65487372738552E7C079955E8BB11B8429473008F3BA5533112C2378
    Session-ID-ctx: 
    Resumption PSK: 4FD14209543187DAC7D78E504D402E36DF9C9C0E9FFFB2857714D1EDD5C1A2AC69F9E2918A3E549A57852A9EFDDC9D3D
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 29 a0 cc ab bc 95 9f 11-2c 7b f1 d9 78 a4 f4 b5   ).......,{..x...
    0010 - 7a 7f f9 b3 e3 69 c0 26-45 da fd c0 8d 9c dc 66   z....i.&E......f
    0020 - 7d b8 c6 1d 1d b1 db d9-c8 55 da d4 c6 c2 11 93   }........U......
    0030 - e8 3a 23 6e 14 a5 0f 13-5f 66 1d 45 70 44 46 5c   .:#n...._f.EpDF\
    0040 - 95 ed 0f 7c 6f 70 19 1d-ad 9d a1 a7 7e a2 68 17   ...|op......~.h.
    0050 - 64 e7 4a 53 1b 26 89 c6-1d ba a3 f9 96 b2 d9 c5   d.JS.&..........
    0060 - c9 4e 29 fd 22 e3 6d a0-a2 59 28 01 5d 29 9e db   .N).".m..Y(.])..
    0070 - 2b c7 de 9e 2b e9 3f ee-70 b9 78 c0 51 b0 1a 82   +...+.?.p.x.Q...
    0080 - 78 5c a5 1a e6 17 3c 6e-f1 9e d8 db e3 65 93 8d   x\....<n.....e..
    0090 - 1e 96 8e fd d5 d7 79 73-75 ee da 53 c7 86 03 5c   ......ysu..S...\
    00a0 - 92 d0 37 fb d6 dc cf d1-0c bc 36 3c 2b c1 7e 0a   ..7.......6<+.~.
    00b0 - 9b 6a 6d 2c 47 49 5a 5d-2d 9f 34 35 47 a8 f4 84   .jm,GIZ]-.45G...
    00c0 - a7 45 27 dc 69 b3 1a de-c0 1f b6 02 3f 09 f4 8a   .E'.i.......?...

    Start Time: 1710663731
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
^C
marcus@marcus-desktop:~$ 
marcus@marcus-desktop:~$ openssl s_client -starttls smtp -crlf -connect mein-server.de:25
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = mail.mein-server.de
verify return:1
---
Certificate chain
 0 s:CN = mail.mein-server.de
   i:C = US, O = Let's Encrypt, CN = R3
   a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar  9 22:02:11 2024 GMT; NotAfter: Jun  7 22:02:10 2024 GMT
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEaTCCA1GgAwIBAgISBEnvZDItomrNNZQs+zuNr/J0MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yNDAzMDkyMjAyMTFaFw0yNDA2MDcyMjAyMTBaMCExHzAdBgNVBAMT
Fm1haWwuYW53YWx0LWNhc3Ryb3AuZGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATi
XdjyHLJCGbTn0Kt8tSl7DCdkjFp6C8t8xxuy9FzgkQG8GCfSnGyGikY+vNLM3hY5
v3ZQeprTqlb8+QvogHbWKHvu0Bwn4AiFxCYIr9Hx11qQ/Y25sH4X7xjf5FujCc2j
ggI2MIICMjAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFMYRNbOt1P1WPAD6a22eqjKr
5qu2MB8GA1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEB
BEkwRzAhBggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUF
BzAChhZodHRwOi8vcjMuaS5sZW5jci5vcmcvMD0GA1UdEQQ2MDSCFm1haWwuYW53
YWx0LWNhc3Ryb3AuZGWCGnd3dy5tYWlsLmFud2FsdC1jYXN0cm9wLmRlMBMGA1Ud
IAQMMAowCAYGZ4EMAQIBMIIBBgYKKwYBBAHWeQIEAgSB9wSB9ADyAHcAO1N3dT4t
uYBOizBbBv5AO2fYT8P0x70ADS1yb+H61BcAAAGOJXPV0QAABAMASDBGAiEA8NTr
nGsJzlH+SJ4/gbC+Z6lqXMqwU4qJMTBrVPHFH5ICIQCzKzY1A2DzzFwa1J2ca/7A
l6cqo4eUwUVMncK+0AKF6wB3AO7N0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZx
H7WbAAABjiVz1dgAAAQDAEgwRgIhAIw+BcyCG7nz3VcZospnlyrrJ5IBQGV6SS2l
CaEUUaT0AiEAoxfb+6rHUAAGHtzF6+pvx05FfDc4jnbl7Vhttg45OrAwDQYJKoZI
hvcNAQELBQADggEBAIW/TZwCvWFpyswjcZMg1Pd9ZmEnvd4OJvtS+7ssWJ135k4f
gXof9didIU+BeZ7mCuVd3weeICBgZ6N1y0NV7mCkbipUTHh6Oq8+Ge9eCJCWihN1
W6oTBDsZlUjRxZSblqHOdgIKjLA7iuHwphyA2cOxa3vO+YZPHGqqVw47nlJNj+PP
HDS9UPeAlISmly7gVKtDDSntB6/FBK3YmYftsz5D4mgj8xoOkkaQ3v0i3jEkKq7l
7qSEeobxTLY1y9vJ0DOEtBaPoMdXuaYPix1B4QcWmytrqssoKMqV4lY0AJp96ukC
OxtE3hYT8gUnbUKSL+jxtnCBVfnHKBFisW+dN5s=
-----END CERTIFICATE-----
subject=CN = mail.mein-server.de
issuer=C = US, O = Let's Encrypt, CN = R3
---
No client certificate CA names sent
Peer signing digest: SHA384
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3111 bytes and written 432 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 384 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
250 DSN
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: B0FA5370185DD9F1F98B49E9F52DA8D4C1966C6D48F9121A5D3A5EE524E6F344
    Session-ID-ctx: 
    Resumption PSK: F7704271E7EB00A87AA9DDE56A3F16B4B555A1562ABC77202CF37298C08BF29766B20EF345B1EE86E3617B2EAB7BD83D
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 29 a0 cc ab bc 95 9f 11-2c 7b f1 d9 78 a4 f4 b5   ).......,{..x...
    0010 - 31 59 fc f5 64 e8 1d fb-eb d9 a1 e4 98 97 c9 d2   1Y..d...........
    0020 - e6 98 3b af 2a 49 f0 66-53 e2 3a b8 b9 5b 8b 47   ..;.*I.fS.:..[.G
    0030 - 6a 42 1e 7a f7 14 fe 7c-be 2c 2c 53 8e 82 73 ee   jB.z...|.,,S..s.
    0040 - 29 c4 fe b8 e3 8f 72 81-45 b0 ae 17 a3 16 60 87   ).....r.E.....`.
    0050 - 46 8b ed 9f 51 cf 56 71-d9 6b 5b ac 2c 08 15 1f   F...Q.Vq.k[.,...
    0060 - 61 51 ef 72 e6 a5 81 3b-cc b8 6d 7c 73 c5 3a 37   aQ.r...;..m|s.:7
    0070 - 09 77 cc 87 b0 60 ca 8b-26 5e e4 5c 19 63 cd 2a   .w...`..&^.\.c.*
    0080 - 08 e1 3d 73 9b 4e 19 dd-02 03 07 bd 8d 30 85 50   ..=s.N.......0.P
    0090 - 13 a5 4f 35 df 7a f6 94-7a 57 39 03 40 98 b3 ee   ..O5.z..zW9.@...
    00a0 - 25 bb 3f 27 5d 1c e1 84-bb 07 3e eb cf ae df d6   %.?'].....>.....
    00b0 - 01 d8 1b bc 16 7d 20 34-28 c9 f5 bb 19 6f 96 d3   .....} 4(....o..
    00c0 - 19 3a 3c 6e 24 75 76 ef-6c c1 62 3c 85 c1 02 38   .:<n$uv.l.b<...8

    Start Time: 1710663755
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

 

Link to comment
Share on other sites
  • 0
d00p Grand Master

d00p

Posted
Posted

Sieht doch alles fein aus, sogar TLSv1.3, da würde ich ja fast behaupten, dass vllt die zwei server die nichts mehr an dich senden können ggfls veraltet sind oder falsch konfiguriert. Offenbar haben die ja eine änderung, wenn deine logs da trotz anonymisierung irgendwie stimmen: IPMAIL1.FremderMailserver <> IPMAIL2.FremderMailserver

Aber zeig doch bitte hierfür auch mal deine postfix config in bezug auf TLS (alles bitte), also z.b.:
  

### TLS settings
###
## TLS for outgoing mails from the server to another server
smtp_tls_security_level = may
smtp_tls_note_starttls_offer = yes
## TLS for email client
smtpd_tls_security_level = may
smtpd_tls_key_file = /root/.acme.sh/domain/domain.key
smtpd_tls_cert_file = /root/.acme.sh/domain/fullchain.cer
smtpd_tls_CAfile = /root/.acme.sh/domain/ca.cer
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5

 

Link to comment
Share on other sites
  • 0
rincewind0803 Apprentice

rincewind0803

Posted
  • Author
Posted

smtp_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_cert_file = /etc/ssl/froxlor-custom/mail.mein-server.de_fullchain.pem
smtpd_tls_key_file = /etc/ssl/froxlor-custom/mail.mein-server.de.key
smtpd_tls_CAfile = /etc/ssl/froxlor-custom/mail.mein-server.de_CA.pem
smtpd_tls_security_level = may
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to question listing


×
×
  • Create New...