STARTTLS Unsupported

[Daniel Hunt]

The SSL-Tools.net STARTTLS test for poste.io fails, stating that STARTTLS is unsupported. See the result for poste.io’s own mailserver: https://ssl-tools.net/mailservers/poste.io

I’m not sure if this is:

• a fault of the tool
• not actually a fault in poste.io (e.g. STARTTLS works fine, just the method this tool uses to test doesn’t)
• actually a fault in poste.io

Thanks.

[SH]

Well, logs are self explaining in this case

2020-06-30T14:38:03.515Z [DEBUG] [core] running capabilities hook in tls plugin
2020-06-30T14:38:03.515Z [DEBUG] [core] hook=capabilities plugin=tls function=advertise_starttls params="" retval=CONT msg="STARTTLS disabled because previous attempt failed"

ssl tools is trying to connect with invalid cyphers I guess. I am not sure if there is way to handle these obsolete clients and respond to tests in right way

‌

[Daniel Hunt]

Thanks for looking into this - we’re now using Poste as our mail server so I just wanted to super sure there weren’t any issues with our setup.

Does this mean there’s no issue? I was trying to find a major mail server (Google, Yahoo, etc) that failed but couldn’t (which was why I thought the fault could potentially lie with Poste).

[Foddy]

We have the same issue with the pro version and are a little bit concerned… :S

[SH]

Foddy it is no issue - it is just mechanism that guarantees receiving emails even from faulty clients. It works like that

1. remote delivery server connects and issue STARTTLS
2. @$!#@!$@#$!
3. remote delivery server disconnects due TLS communication issues (old TLS/SSL or no matching cyphers)
4. Haraka disables STARTTLS for that IP
5. remote delivery server reconnects and do not issue STARTTLS, tries deliver instead

Problem is that it is kind of incompatible with these tests if they purposefully try to connect with old cyphers.

[Roman]

I think this can be major problem.

If there is single faulty client in your network (eg. in company behind NAT) STARTTLS may be disabled by mailserver for whole IP address for 1 hour

[NOTICE] [tls] STARTTLS failed. Marking XXX.XXX.XXX.XXX as non-TLS host for 3600 seconds

Then other clients in same network (behind same ip address) can’t use TLS as well (and can’t send email at all).