Subject: Random SSL negotiation failures with 4.4{2,3}

From: Kenneth Crudup <[email-masked]>
Date: Fri, 14 Dec 2001 09:45:42 -0800 (PST)

My outgoing SMTP host is set to use authorization and SSL (with
novalidate_cert). That works well, but every now and then, at random, I'll
get SSL negotiation failures:

----
SSL/TLS failure for mailhost.panix.com: SSL negotiation failed
----

... so I'll get bounced back to either the editing session, or the ready-to-
send screen, where if I try to "Ctrl-X" once or twice more, it'll eventually
send the message w/o the above message. After that, things are OK again.

My ISP seems to think it's not their fault:

----
Nov 20 15:14:41 mail2 stunnel[13580]: smtp connected from 209.244.75.123:1138
Nov 20 15:14:41 mail2 stunnel[13580]: Unknown client EHLO
Nov 20 15:14:41 mail2 stunnel[13580]: Protocol negotiations failed

The service on port 465 was raised in a highly formal culture.  It
won't do business with you (talk SMTP) until you sit down and have
a cup of tea with it (negotiate an SSL session).  It considers your
attempt to talk SMTP first gauche and ill-mannered, so it exits.
----

... so, I wondered if anyone else's seen this. I've seen it on Pine 4.42 and
.43 .

	-Kenny

-- 
Kenneth R. Crudup   Sr. SW Engineer, Scott County Consulting, Washington, D.C.
Home1: PO Box 914         Silver Spring, MD 20910-0914         [email-masked]
Home2: 38010 Village Cmn. #217  Fremont, CA 94536-7525          (510) 745-0101
Work: 5141 California Suite 200, Irvine, CA 92612               (949) 737-2785

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 14 Dec 2001 23:00:56 -0800 (PST)

> SSL/TLS failure for mailhost.panix.com: SSL negotiation failed

This error message occurs when the server fails to do initial SSL
negotiation.  The actual error condition occurred in the bowels of the
OpenSSL library.  SSL negotiation failed" is Pine's default message for an
OpenSSL error when OpenSSL does not pass up any error message.

Generally, it means that the server closed the connection without
transmitting any SSL negotiations, although it can also happen if the
server sent non-SSL data.

stunnel, which your ISP uses, is also OpenSSL-based.

> attempt to talk SMTP first gauche and ill-mannered, so it exits.

Try talking with your ISP again; but this time, speak with someone who
spends more time investigating a problem report and less time making
cutesy comments.

The person that you talked to seems to be under the mistaken impression
that "Unknown client EHLO" means that Pine sent an unencrypted EHLO to the
SSL SMTP server.  I don't know what that message means (it isn't in my
copy of the stunnel sources), but it is impossible for Pine to send an
EHLO unless it first receives a 220 greeting.

Furthermore, any Pine error message starting with "SSL/TLS failure" occurs
after the TCP/IP connection was opened, and before there is any attempt to
read a 220 greeting or send an EHLO.

It's possible that those error messages aren't even from a Pine session,
but rather from something else; e.g. someone trying to telnet to that
port.

By the way, I know why you have had to use /novalidate-cert.  The SSL
certificate used by mailhost.panix.com is for "pop3s.panix.com" which
happens to use the same IP addresses.  Apparently the programmers at Panix
have not yet mastered the technique of sending appropriate certificates.
If you set smtp-server in your Pine configuration to "pop3s.panix.com" you
won't need to use /novalidate-cert, at least not until they fix their
misconfigured server.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.