Microsoft 365 SMTP relay problem

continuality

We've just migrated away from Google Workspace to Microsoft 365 for email. I am attempting to use the smtp.office365.com relay, with a verified, known good password for the user account. However, I keep getting an error message:
TLS/SSL failure for smtp.office365.com: SSL negotiation failed
I am not sure how to resolve this, having tried multiple different options and ensuring that the account has SMTP auth enabled.

KevinTheJedi

continuality

You need to provide your system information (a screenshot of the information page is always helpful) as well as what your SMTP settings look like.

I will say, judging by the error you provided, that it sounds like your webserver is having trouble negotiating SSL/TLS with the provided SMTP server. Try to test the SSL/TLS connection to the SMTP server via the webserver.

Cheers.

continuality

Here is the server info and email address setup. I am able to connect to the SMTP relay manually:

root@myhost:/var/www/html/osTicket# openssl s_client -connect smtp.office365.com:587 -starttls smtp
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com
   i:C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
 1 s:C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIIpTCCB42gAwIBAgIQDxLciVWCHW2Ta8805Q9gxTANBgkqhkiG9w0BAQsFADBL
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSUwIwYDVQQDExxE
aWdpQ2VydCBDbG91ZCBTZXJ2aWNlcyBDQS0xMB4XDTIyMDcyNjAwMDAwMFoXDTIz
MDcyNTIzNTk1OVowajELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
bjEUMBIGA1UEAxMLb3V0bG9vay5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDExqNeJz0HhPtPKSmy4DkZwslNIXxjFMAWx39xzl8xZDjcrrPXEca1
6hBDy303zQE0r3IOni/003PH/Jev1lEVhwHjitV31L/jqJBG0N4U4DroAP/xo/eu
mFxnQ2LprpH7gqTYjT6EPtL+B4SwiqN5PdNceD14TitOLBnRPtVv4bXRp7Ha/edE
LgsW42fEsj/tA5xILLxt3gsxjOdIFWHwhyX61ljd+21AI2m4M0noXlXBAsRZNlg0
S3IY4iFT/qcCJHFBcHKlUiI0rYffV99oOBFXCZSMwOR329q1SyJjDFT+kK4B7sRp
mbd7OGD10YJ0OH1M9V7EmbvS9xa4dZfxAgMBAAGjggVkMIIFYDAfBgNVHSMEGDAW
gBTdUdCiMXOpc66PtAF+XYxXy5/w9zAdBgNVHQ4EFgQUcrf5PM7TwFPdaxXdnVcp
nzMoKfgwggIQBgNVHREEggIHMIICA4IWKi5jbG8uZm9vdHByaW50ZG5zLmNvbYIN
Ki5ob3RtYWlsLmNvbYIWKi5pbnRlcm5hbC5vdXRsb29rLmNvbYIKKi5saXZlLmNv
bYIWKi5ucmIuZm9vdHByaW50ZG5zLmNvbYIMKi5vZmZpY2UuY29tgg8qLm9mZmlj
ZTM2NS5jb22CDSoub3V0bG9vay5jb22CFyoub3V0bG9vay5vZmZpY2UzNjUuY29t
ghthdHRhY2htZW50Lm91dGxvb2subGl2ZS5uZXSCHWF0dGFjaG1lbnQub3V0bG9v
ay5vZmZpY2UubmV0giBhdHRhY2htZW50Lm91dGxvb2sub2ZmaWNlcHBlLm5ldIIW
YXR0YWNobWVudHMub2ZmaWNlLm5ldIIaYXR0YWNobWVudHMtc2RmLm9mZmljZS5u
ZXSCHWNjcy5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tgiFjY3Mtc2RmLmxvZ2lu
Lm1pY3Jvc29mdG9ubGluZS5jb22CC2hvdG1haWwuY29tghZtYWlsLnNlcnZpY2Vz
LmxpdmUuY29tgg1vZmZpY2UzNjUuY29tggtvdXRsb29rLmNvbYISb3V0bG9vay5v
ZmZpY2UuY29tghRzdWJzdHJhdGUub2ZmaWNlLmNvbYIYc3Vic3RyYXRlLXNkZi5v
ZmZpY2UuY29tMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwgY0GA1UdHwSBhTCBgjA/oD2gO4Y5aHR0cDovL2NybDMuZGlnaWNl
cnQuY29tL0RpZ2lDZXJ0Q2xvdWRTZXJ2aWNlc0NBLTEtZzEuY3JsMD+gPaA7hjlo
dHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRDbG91ZFNlcnZpY2VzQ0Et
MS1nMS5jcmwwPgYDVR0gBDcwNTAzBgZngQwBAgIwKTAnBggrBgEFBQcCARYbaHR0
cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMHwGCCsGAQUFBwEBBHAwbjAlBggrBgEF
BQcwAYYZaHR0cDovL29jc3B4LmRpZ2ljZXJ0LmNvbTBFBggrBgEFBQcwAoY5aHR0
cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0Q2xvdWRTZXJ2aWNlc0NB
LTEuY3J0MAwGA1UdEwEB/wQCMAAwggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB2
AOg+0No+9QY1MudXKLyJa8kD08vREWvs62nhd31tBr1uAAABgjnW85EAAAQDAEcw
RQIgLhN1N0Z3HEmJ0TD7SRYIVDiHgzSDrZCgBf2IT0lXZSgCIQDw6zN6TD1330Xh
1KBXZljNZWIlTJ4r9xi9wZ106kVgwwB1ADXPGRu/sWxXvw+tTG1Cy7u2JyAmUeo/
4SrvqAPDO9ZMAAABgjnW8voAAAQDAEYwRAIgB4KLMe5ZgCB5IwfS3fZUbPNGTUJ2
9SPYi4ILrj68EeQCIGWn/7YkImZ0gmGO1RujumE2l1yF/bYujBkeysD5yRKwAHYA
s3N3B+GEUPhjhtYFqdwRCUp5LbFnDAuH3PADDnk2pZoAAAGCOdbzMwAABAMARzBF
AiEAhVbwtFZ5oSR6efbYNZAHlVodkj9SifCwoFrK4xi9CmECIHyhp7lK1Po0zCVj
igg2BkQgBv0+3n9egZ6QCh2r8NNqMA0GCSqGSIb3DQEBCwUAA4IBAQDLhOIXjbqd
zfFNBHENvGMFFfVOp3Fs/81rTKD5VEIaQWJcmMXeU6g65NnHDCJdkIt8A13OGHc8
UHOGIinbyJvCxq724Bv+wkni69k9cQSAm1YjK26QEIVlVuobSIJGd/AK4QGC9OXo
Xl3MD1xfTXkuxHOVqxm1EN+Cf+XBvw3TVHM8+bt7w9GYtAcmCAQTl0fNSnt7JJME
69TUOjumKuePU6RVszSErXPcoEdP3tzTlMcBoAmORYqs6ukasZBUfwKd0noVNt6z
pxceFjtXY0SXOUppPjm7KiJ6fSibXHP2cal8JEbqaHMKIeFE8ab0Gnt9AH7KMb7+
NwpRQbro93RX
-----END CERTIFICATE-----
subject=C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com

issuer=C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1

---
No client certificate CA names sent
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA1:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA1:DSA+SHA1:RSA+SHA512:ECDSA+SHA512
Shared Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:ECDSA+SHA256:ECDSA+SHA384:RSA+SHA512:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 4379 bytes and written 513 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 31420000368002E598647F56131031769EA2A373F37F71193C41994D63AEC127
    Session-ID-ctx:
    Master-Key: F2CE4AF9EBDDCE64183602C356D711FB6D5834CCF08CA9261C9D70C99C8285C3D402CC528E5162390939FBD09202F802
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1661864512
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
250 SMTPUTF8

KevinTheJedi

continuality

🤦‍♂️ You cannot use SMTP for IMAP...these are two separate mechanisms. You need to check your provider's documentation on what the appropriate IMAP information to use is. Once you update this you should be good.

Cheers.

continuality

KevinTheJedi We aren't using IMAP, and it isn't set that way.

KevinTheJedi

continuality

You have the SMTP host name and port configured for the Fetching section which you cannot do. Do what I said above but for POP instead.

Cheers.

Daedalus01

continuality The hostname and port for POP/IMAP access for Office 365 is not SMTP.office365.com port 587. Its outlook.office365.com and 110 for Unsecured POP and 995 for SSL POP @KevinTheJedi is correct.

continuality

Daedalus01 Oops, yep, I fixed it. I think this is simply an authentication failure now. Working on that. Thanks for jogging my brain here, guys.