ssl handshake problem with bugs.debian.org?
Hi folks,
I've got a ssl handshake problem with bugs.debian.org on sending an EMail.
My mta (OpenBSD 6.7, i.e. libressl) in the office says in its logfile
:
Jul 27 10:23:37 gate5a smtpd[67056]: d4df9298d18e1596 mta connecting address=smtp://209.87.16.39:25 host=buxtehude.debian.org
Jul 27 10:23:37 gate5a smtpd[67056]: d4df9298d18e1596 mta connected
Jul 27 10:23:39 gate5a smtpd[67056]: d4df9298d18e1596 mta tls ciphers=TLSv1.3:AEAD-AES256-GCM-SHA384:256
Jul 27 10:23:39 gate5a smtpd[67056]: d4df9298d18e1596 mta server-cert-check result="failure"
Jul 27 10:23:39 gate5a smtpd[67056]: d4df9299bfe4df24 mta connecting address=smtp://[2607:f8f0:614:1::1274:39]:25 host=buxtehude.debian.org
Jul 27 10:23:39 gate5a smtpd[67056]: d4df9298d18e1596 mta error reason=IO Error: error:1404C410:SSL routines:ST_OK:sslv3 alert handshake failure
Jul 27 10:23:39 gate5a smtpd[67056]: smtp-out: Disabling route 5.145.142.10 <-> 209.87.16.39 (buxtehude.debian.org) for 15s
Jul 27 10:23:39 gate5a smtpd[67056]: d4df9299bfe4df24 mta connected
Jul 27 10:23:41 gate5a smtpd[67056]: d4df9299bfe4df24 mta tls ciphers=TLSv1.3:AEAD-AES256-GCM-SHA384:256
Jul 27 10:23:41 gate5a smtpd[67056]: d4df9299bfe4df24 mta server-cert-check result="failure"
Jul 27 10:23:41 gate5a smtpd[67056]: d4df9299bfe4df24 mta error reason=IO Error: error:1404C410:SSL routines:ST_OK:sslv3 alert handshake failure
Jul 27 10:23:41 gate5a smtpd[67056]: smtp-out: Disabling route [2001:67c:13b0:ffff::60] <-> [2607:f8f0:614:1::1274:39] (buxtehude.debian.org) for 15s
Jul 27 10:23:41 gate5a smtpd[67056]: smtp-out: Address family mismatch on [connector:[2001:67c:13b0:ffff::60]->[relay:bugs.debian.org,smtp,sourcetable=<dynamic:2>,heloname=mail.aixigo.de],0x0]
Jul 27 10:23:41 gate5a smtpd[67056]: smtp-out: Address family mismatch on [connector:5.145.142.10->[relay:bugs.debian.org,smtp,sourcetable=<dynamic:2>,heloname=mail.aixigo.de],0x0]
:
Please note the "sslv3 alert handshake failure".
We send a bazillion of EMails via this MTA each day. This handshake
problem shows up only for buxtehude, AFAICT. Is there a compatibility
issue with openssl in Debian and libressl used in OpenBSD 6.7? AFAIU
TLS 1.3 is not in libressl yet.
Every helpful hint is highly appreciated.
Harri
Reply to: