TLS error on IMAPS and SMTPS

madsem

Hi all!
I'm on a Plesk domain, and I'm using:
Versione osTicket v1.17.2 (8fbc7ee)
Web Server Software Apache
Versione MySQL 10.3.35
Versione PHP 8.0.28

I've spent my last 9 hours reading this forum and github, testing all solutions, but none is working for me.
But I'm unable to fetch mail via IMAPS.
When I try to test credentials this is the error:

When I save correct parameters this is the error:

I made some try with tls://servername or with ssl://servername, nothing. Nothing appear in OST logs )with debug level set) and nothing also in server logs. Neither in mailserver log.
But if I try to connect via "openssl connect", I login as expected in mailbox.

How can I debug or what can I try?

Thanks to all!

KevinTheJedi

madsem

It cannot connect to the host and port for some reason. Maybe firewall issues or something? Are you using a hosting provider? If so can you check with them to see if they have any sort of restrictions? Also, do you have a self-signed cert?

Other than that I can only suggest applying the latest patches on Github from protich and jedikev and retest or wait for the next release (aiming for this week or next).

Cheers.

madsem

Hi!
Thanks for your reply.
Firewall was my first check, but a "permit all" rule just for testing is enabled.
I'm the hosting provider (we are a little ISP) and for testing WAF is disabled, modsecurity is disabled, IPS is disabled :-(
SSL cert is a wildcard Comodo that we use for our mail infrastructure (Zimbra based).
Tomorrow I'll check patches you mention, thanks!

The strangest thing is that log are empty... Nothing appear on them :-/

Thanks!

Regards,

Sem

KevinTheJedi

madsem

Yea there will be no logs as it simply cannot connect. Typically this is caused by firewall but in some cases the webserver needs to be whitelisted at the mailserver level (however this is in rare cases). If all else fails you should be able to check your server logs and see if it's failing on the webserver end or check your mail server logs to see if the connection is being refused from that end. You can contact your mail provider to have them check the logs on their side.

Cheers.

madsem

Hi!
I found the trouble.
OSTicket is using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384, that is not yet implemented in our email infrastructure.
Now I look for docs on how to force OSTickt to use TLS1.2 until we upgrade our email infrastructure.

Thanks!

ntozier

I would start with searching the code base for "TLS"
https://github.com/osTicket/osTicket/search?q=TLS

madsem

I solved it by anticipating the maintenance we had to do to the mail infrastructure to bring everything to TLS1.3, which we had been procrastinating for too long. Done, OSTicket has taken to working perfectly, as it should! I leave only one note that it has problems with TLS1.2, so we ascertained.

Thank you all for your help, much appreciated!