FreeBSD 12.0-p3 sendmail openssl Google

[Dave Cottlehuber]

On Wed, 1 May 2019, at 17:53, Dave Cottlehuber wrote:
> On Tue, 30 Apr 2019, at 22:57, David K. Gerry wrote:
> > Greetings,
> > 
> > 	I upgraded to FreeBSD 12.0-p3 on Wednesday using make installworld,
> > mergemaster, etc. Since then I have not been able to recieve e-mail from
> > Google with the following error in the mail log.
> > 
> > Apr 30 18:14:07 john-steed sm-mta[32581]: STARTTLS=server, error: accept
> > failed=-1, reason=sslv3 alert illegal parameter, SSL_error=1, errno=0,
> ------------------------^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^---------------------
> 
> Hi David,
> 
> TLDR: use TLS1.1 at minimum, preferred 1.2 & share more info to reduce
> speculation. SSLv2 is vulnerable to a bunch of attacks.

[moving reply back to list, content elided]

The error message from google is very clear: something is broken with
your SSL stuff, and you'll need to fix that first. The cause, unfortunately,
is not provided.

Using the openssl tool against your domain MX server shows this:

verify error:num=19:self signed certificate in certificate chain

I have a few tools for checking TLS for websites, but nothing for TLS
for SMTP etc. I found this, run by the EFF:

https://starttls-everywhere.org/ which showed 2 errors:

Failure: Name in cert doesn't match hostname: x509: 
ertificate is not valid for any names, but wanted to match mail.xyz

Failure: Certificate root is not trusted: x509: certificate signed by unknown authority

Hopefully that's enough for you to fix things.

https://forums.freebsd.org/threads/sendmail-and-letsencrypt.57675/ may be of interest.

A+
Dave