sendmail via stunnel with smtp.frontier.com:465

Moderator: cah

Post Reply
cah
General of the Army / Fleet Admiral / General of the Air Force
General of the Army / Fleet Admiral / General of the Air Force
Posts: 1342
Joined: Sun Aug 17, 2008 5:05 am

sendmail via stunnel with smtp.frontier.com:465

Post by cah »

The stunnel with TLSv1 has been working for years until around 07/15/2021. The connection was reset according to both stunnel and sendmail log.

After numerous testings, I found out the error messages are different when I changed from TLSv1 to TLSv1.1 or TLSv1.2.

I then use openssl to test the connection to smtp.frontier.com:465. Following are the output from 4 different versions:

SSLv3:

Code: Select all

openssl s_client -connect smtp.frontier.com:465 -ssl3
CONNECTED(00000003)
139817024759696:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1493:SSL alert number 40
139817024759696:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported  <== TLSV1 is NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1627336410
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
TLSv1:

Code: Select all

openssl s_client -connect smtp.frontier.com:465 -tls1  
CONNECTED(00000003)
140677476804496:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1493:SSL alert number 40
140677476804496:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported  <== TLSV1 is NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1627336421
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
TLSv2:

Code: Select all

openssl s_client -connect smtp.frontier.com:465 -tls1_1
CONNECTED(00000003)
depth=2 C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2009 Entrust, Inc. - for authorized use only", CN = Entrust Root Certification Authority - G2
verify return:1
depth=1 C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2012 Entrust, Inc. - for authorized use only", CN = Entrust Certification Authority - L1K
verify return:1
depth=0 C = US, ST = New York, L = Rochester, O = Frontier Communications, CN = *.frontier.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=New York/L=Rochester/O=Frontier Communications/CN=*.frontier.com
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
 1 s:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIG0DCCBbigAwIBAgIQHFaTuscRYDf5IopoTID5WzANBgkqhkiG9w0BAQsFADCB
ujELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsT
H1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAy
MDEyIEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEuMCwG
A1UEAxMlRW50cnVzdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEwxSzAeFw0y
MTA2MTYxODMxMDJaFw0yMjA3MDkxODMxMDFaMG8xCzAJBgNVBAYTAlVTMREwDwYD
VQQIEwhOZXcgWW9yazESMBAGA1UEBxMJUm9jaGVzdGVyMSAwHgYDVQQKExdGcm9u
dGllciBDb21tdW5pY2F0aW9uczEXMBUGA1UEAwwOKi5mcm9udGllci5jb20wggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCl3jvZz0GoAlG7G72KEHLBd55f
CMbj9mNFFyaLIPZi635i2JXVluw3MQnJTq+wbqAPtTpAvtNgm14CrDrc60wUsQpc
idQGZY58zFp8EjTQPEypcM6gjdV8TwF52OZHg3roTQdMXRwsRSw1p2m8UKfd/nxg
moRQtXPS4e1xk6n1mI+iOYyArLA51SYwYM0Y3pModDrnBuHQlTLtR0SiOjiY7qUo
VWEZabSw/GrRuFmUuTmPhXwjumDyatupF8dL/pIxqcNE9fyVcnTZ1YIH19p2eRGT
8C/pcpdSKBX/+2y7f9aJb/DMJ2ZDb679kqJd1dSiRfztbxILhOV79kDO+UrFAgMB
AAGjggMaMIIDFjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQZhld4rWjlaHzVxFtl
TL0lyuW3sDAfBgNVHSMEGDAWgBSConB03bxTP8971PfNf6dgxgpMvzBoBggrBgEF
BQcBAQRcMFowIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmVudHJ1c3QubmV0MDMG
CCsGAQUFBzAChidodHRwOi8vYWlhLmVudHJ1c3QubmV0L2wxay1jaGFpbjI1Ni5j
ZXIwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbnRydXN0Lm5ldC9sZXZl
bDFrLmNybDAnBgNVHREEIDAegg4qLmZyb250aWVyLmNvbYIMZnJvbnRpZXIuY29t
MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
TAYDVR0gBEUwQzA3BgpghkgBhvpsCgEFMCkwJwYIKwYBBQUHAgEWG2h0dHBzOi8v
d3d3LmVudHJ1c3QubmV0L3JwYTAIBgZngQwBAgIwggF/BgorBgEEAdZ5AgQCBIIB
bwSCAWsBaQB3AFYUBpov18Ls0/XhvUSyPsdGdrm8mRFcwO+UmFXWidDdAAABehYX
SeEAAAQDAEgwRgIhANqXvVWnSzyjN+Db0TOYky+4KiFwYcZhLHDppqZQ9aAoAiEA
3uVGxFXpmYLTaPP/Y4clHFNIQ1EoskpTwNFMpB4xm3EAdgBGpVXrdfqRIDC1oolp
9PN9ESxBdL79SbiFq/L8cP5tRwAAAXoWF0m9AAAEAwBHMEUCIQD6br+T4KU5NwcN
a5v2V05CXzUxviyidU+PljkQQrQHGQIgOsFvsvaINHybXWkHak/88xaXe++T4CPp
oi7LF08QcYUAdgBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAXoW
F0n2AAAEAwBHMEUCIDZ931a5YQJ1dBN9GV2G0Q4MEl9QN19OMvQo0x8DPA0aAiEA
65RjcvlLMPtiwFFk0yfMcpyNud5yTOeMuRJGkfjnDmwwDQYJKoZIhvcNAQELBQAD
ggEBADrYevhE3lIjEhHyoHEGy8XBNxAvNezwgwiIyBuggbmgsMdl4ONk9g8scNk9
Jj3Pb7ODbGHDc5N7pul7uO4i6cregYcnHD2ZVBbjY6VSU9ObgjHl1jf+8IsEGBau
HAj/inr5CVHLtvTr1n+vXV0n1d/ZyGKryUt2CKQqnN3xy4wm4zVQ1L/tixoYrzSF
yNBbR75tx2BegR58ZrlfDSKnjVRb2nHzejbLyQ+fpTA6ZXrYI6avqmSa2qg5eDVI
P0APniai2tLN8VpBSpqVR9MwXPwbjkhm8fzlefgfvfaws9ociki8nCLReu4yZJEX
SohcMG5bzOFJjdI3uPE8WQzSK4Q=
-----END CERTIFICATE-----
subject=/C=US/ST=New York/L=Rochester/O=Frontier Communications/CN=*.frontier.com
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
---
No client certificate CA names sent
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3576 bytes and written 331 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported <== TLSv1.1 IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-AES128-SHA
    Session-ID: AA006CDB7FC5603F93C9CCF5E70D08C7FF7582B482AB571255671B93B69D58D7
    Session-ID-ctx: 
    Master-Key: B5EE50092DB1B6F60F5EACC4E1C86AB1C1575A7B1FDAC445594B0FDC9E9DBFFEB78415CCFA0B5159E2492450CAF27710
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1627336743
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
read:errno=104
TLSv1.2

Code: Select all

openssl s_client -connect smtp.frontier.com:465 -tls1_2
CONNECTED(00000003)
depth=2 C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2009 Entrust, Inc. - for authorized use only", CN = Entrust Root Certification Authority - G2
verify return:1
depth=1 C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2012 Entrust, Inc. - for authorized use only", CN = Entrust Certification Authority - L1K
verify return:1
depth=0 C = US, ST = New York, L = Rochester, O = Frontier Communications, CN = *.frontier.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=New York/L=Rochester/O=Frontier Communications/CN=*.frontier.com
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
 1 s:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIG0DCCBbigAwIBAgIQHFaTuscRYDf5IopoTID5WzANBgkqhkiG9w0BAQsFADCB
ujELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsT
H1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAy
MDEyIEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEuMCwG
A1UEAxMlRW50cnVzdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEwxSzAeFw0y
MTA2MTYxODMxMDJaFw0yMjA3MDkxODMxMDFaMG8xCzAJBgNVBAYTAlVTMREwDwYD
VQQIEwhOZXcgWW9yazESMBAGA1UEBxMJUm9jaGVzdGVyMSAwHgYDVQQKExdGcm9u
dGllciBDb21tdW5pY2F0aW9uczEXMBUGA1UEAwwOKi5mcm9udGllci5jb20wggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCl3jvZz0GoAlG7G72KEHLBd55f
CMbj9mNFFyaLIPZi635i2JXVluw3MQnJTq+wbqAPtTpAvtNgm14CrDrc60wUsQpc
idQGZY58zFp8EjTQPEypcM6gjdV8TwF52OZHg3roTQdMXRwsRSw1p2m8UKfd/nxg
moRQtXPS4e1xk6n1mI+iOYyArLA51SYwYM0Y3pModDrnBuHQlTLtR0SiOjiY7qUo
VWEZabSw/GrRuFmUuTmPhXwjumDyatupF8dL/pIxqcNE9fyVcnTZ1YIH19p2eRGT
8C/pcpdSKBX/+2y7f9aJb/DMJ2ZDb679kqJd1dSiRfztbxILhOV79kDO+UrFAgMB
AAGjggMaMIIDFjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQZhld4rWjlaHzVxFtl
TL0lyuW3sDAfBgNVHSMEGDAWgBSConB03bxTP8971PfNf6dgxgpMvzBoBggrBgEF
BQcBAQRcMFowIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmVudHJ1c3QubmV0MDMG
CCsGAQUFBzAChidodHRwOi8vYWlhLmVudHJ1c3QubmV0L2wxay1jaGFpbjI1Ni5j
ZXIwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbnRydXN0Lm5ldC9sZXZl
bDFrLmNybDAnBgNVHREEIDAegg4qLmZyb250aWVyLmNvbYIMZnJvbnRpZXIuY29t
MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
TAYDVR0gBEUwQzA3BgpghkgBhvpsCgEFMCkwJwYIKwYBBQUHAgEWG2h0dHBzOi8v
d3d3LmVudHJ1c3QubmV0L3JwYTAIBgZngQwBAgIwggF/BgorBgEEAdZ5AgQCBIIB
bwSCAWsBaQB3AFYUBpov18Ls0/XhvUSyPsdGdrm8mRFcwO+UmFXWidDdAAABehYX
SeEAAAQDAEgwRgIhANqXvVWnSzyjN+Db0TOYky+4KiFwYcZhLHDppqZQ9aAoAiEA
3uVGxFXpmYLTaPP/Y4clHFNIQ1EoskpTwNFMpB4xm3EAdgBGpVXrdfqRIDC1oolp
9PN9ESxBdL79SbiFq/L8cP5tRwAAAXoWF0m9AAAEAwBHMEUCIQD6br+T4KU5NwcN
a5v2V05CXzUxviyidU+PljkQQrQHGQIgOsFvsvaINHybXWkHak/88xaXe++T4CPp
oi7LF08QcYUAdgBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAXoW
F0n2AAAEAwBHMEUCIDZ931a5YQJ1dBN9GV2G0Q4MEl9QN19OMvQo0x8DPA0aAiEA
65RjcvlLMPtiwFFk0yfMcpyNud5yTOeMuRJGkfjnDmwwDQYJKoZIhvcNAQELBQAD
ggEBADrYevhE3lIjEhHyoHEGy8XBNxAvNezwgwiIyBuggbmgsMdl4ONk9g8scNk9
Jj3Pb7ODbGHDc5N7pul7uO4i6cregYcnHD2ZVBbjY6VSU9ObgjHl1jf+8IsEGBau
HAj/inr5CVHLtvTr1n+vXV0n1d/ZyGKryUt2CKQqnN3xy4wm4zVQ1L/tixoYrzSF
yNBbR75tx2BegR58ZrlfDSKnjVRb2nHzejbLyQ+fpTA6ZXrYI6avqmSa2qg5eDVI
P0APniai2tLN8VpBSpqVR9MwXPwbjkhm8fzlefgfvfaws9ociki8nCLReu4yZJEX
SohcMG5bzOFJjdI3uPE8WQzSK4Q=
-----END CERTIFICATE-----
subject=/C=US/ST=New York/L=Rochester/O=Frontier Communications/CN=*.frontier.com
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3554 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported <== TLSv1.2 IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 167CB9B6AA006DDA7EC42F2393C994E39AE73698B66F5BB6366B4F2F6259E4F3
    Session-ID-ctx: 
    Master-Key: 25832A16138C59E9F5FC463CB43F7FB329ACFE63CA08378AE7BB1046CC6B9423CA168A4DD5BAC3B9683112FBAF7EAD8C
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1627336808
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
read:errno=104
From the output, it looks like both TLSv1.1 and TLSv1.2 are supported but the stunnel from my server to smtp.frontier.com:465 is still not working.

Code: Select all

2021.07.26 17:51:53 LOG5[19917:139752398604032]: SSL socket error: Connection reset by peer (104)
2021.07.26 17:51:53 LOG5[19917:139752398604032]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
Not sure what Frontier did to their server to cause the connection issue........
CAH, The Great
Top
cah
General of the Army / Fleet Admiral / General of the Air Force
General of the Army / Fleet Admiral / General of the Air Force
Posts: 1342
Joined: Sun Aug 17, 2008 5:05 am

sendmail to smtp.frontier.com:587

Post by cah »

Since smtp.frontier.com:465 didn't work, I tried to find if port 587 is running on the server and it is.

I then modified sendmail.cf to go directly to smtp.frontier.com:587 bypassing stunnel and it worked!

Not sure how long this will work but it is working now.
CAH, The Great
Top
Post Reply

Return to “Technology / 科技交流”