STARTTLS failed

daulton

Server Information
osTicket Version v1.11 (7b1eee8) — Up to date
Web Server Software nginx/1.14.0
MySQL Version 10.0.36
PHP Version 7.2.10
OS: OpenBSD 6.4

Package information:
dovecot-2.2.36p0
postfix-3.3.1p0-sasl2-pgsql

Installed Language Packs
English (United States)

What I am trying to do:

I am trying to setup email in osTicket to be able to send and receive. However when I am setting this up, particularly in configuring the "Sending Email via SMTP" section I receive an error.

Error I am getting:

In the interface at Admin Panel > Email > Emails > support@mydomain.com I am updating the email address to have the correct details. In the "Sending Email via SMTP" section when I fill it out I get this error:

authentication failure [SMTP: STARTTLS failed (code: 220, response: 2.0.0 Ready to start TLS)]

In the mail log on the mail server I see this:

Apr 5 01:39:15 mx postfix/submission/smtpd[76257]: connect from <my reverse DNS name here>[my IP address here]
Apr 5 01:39:16 mx postfix/submission/smtpd[76257]: SSL_accept error from <my DNS name here>[my IP address here]: 0
Apr 5 01:39:16 mx postfix/submission/smtpd[76257]: warning: TLS library problem: error:14037418:SSL routines:ACCEPT_SR_KEY_EXCH:tlsv1 alert unknown ca:/usr/src/lib/libssl/ssl_pkt.c:1200:SSL alert number 48:
Apr 5 01:39:16 mx postfix/submission/smtpd[76257]: lost connection after STARTTLS from <my reverse DNS name here>[my IP address here]
Apr 5 01:39:16 mx postfix/submission/smtpd[76257]: disconnect from <my reverse DNS name here>[my IP address here] ehlo=1 starttls=0/1 commands=1/2

Please let me know what other details you may need. I would really like to fix this so I can use osTicket, it seems like a great system but if I cannot send or receive email its not too useful for me sadly

ntozier

osTicket does not support nginx. It could be related to that.

What are the settings that you are using for smtp?

Are you using a real SSL certificate?
https://serverfault.com/questions/238476/lost-connection-after-starttls-postfix

daulton

ntozier ntozier

As a test I tried having a valid SSL cert on the osticket host and it fails with the same error.

daulton

Thanks for your reply. I will switch to Apache for testing as soon as I can and report back.

Domain name is blotted out for privacy, but in all the relevant places it says mx.<my domain> and support@<my domain>.
The problem begins when I switch Authentication Required from No to Yes, that is when it gives the error I listed in the OP

As for if I am using a real SSL certificate, are you meaning on the mail server? If so, then yes I have a Lets Encrypt cert for mx.<my domain>

ramrajone

daulton
Take a look at this blog you may get some ideas for email settings
https://howtohelpdesk.com/osticket-email-settings/

daulton

ramrajone

Thank you for the response. I have tried many different settings and searched for configuration help already. I believe this to be a bug, however I am wanting to first seek help on the forum before submitting an issue on Github as a courtesy just encase this can be resolved or I messed up.

KevinTheJedi

@daulton

You'll have to check your mailserver connection/error logs for any related errors. Do you have plain-text auth enabled on the mailserver? Do you have a "less-secure-apps" setting and if so, is it enabled?

It's most likely not a bug with the code, rather a misconfiguration in your webserver/mailserver as many, many people can authenticate just fine against their mailservers. I can authenticate against Gmail, YaHoo, Exchange, etc. just fine.

Cheers.

daulton

I got tired of troubleshooting this and did what seems like a clean workaround. Heres what I did, this will allow you to send mail via osticket if you end up in a similar spot as I

touch /etc/mail/secrets
chmod 640 /etc/mail/secrets
chown root:_smtpd /etc/mail/secrets
echo "support support@example.com:password" > /etc/mail/secrets

/etc/mail/smtpd.conf would look like this:

table aliases file:/etc/mail/aliases
table secrets file:/etc/mail/secrets

listen on lo0

action "local" mbox alias <aliases>
action "relay" relay host smtp+tls://support@mx.example.com:587 \
auth <secrets>

match for local action "local"
match for any action "relay"

Modified this slightly, but the source is here: http://man.openbsd.org/OpenBSD-6.4/smtpd.conf#EXAMPLES

Enable at boot and start the daemon:

rcctl enable smtpd
rcctl start smtpd

In the osTicket mail settings use the following:

Sending Email via SMTP

Status: Enable
Hostname: 127.0.0.1
Port Number: 25
Authentication Required: No

Do not try to use these settings for fetching, use your actual mx.

wherami

$this->phpmailer->SMTPOptions = array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
)
);
this is what you have to put in if you have a self signed cert and then everything works great.

daulton

wherami

Thanks for the details. However during my testing I tried with a Lets Encrypt cert and it did not work as well, so I am still using my work around as noted above.