On Wed, Feb 26, 2020 at 12:27:09PM +0000, Jeremy Harris via Exim-users wrote: > We're not too much closer. They agreed, during handshake, on a > cipher-suite. We can't actually tell if the handshake completed > (because encryption!) but the packets present make it likely. > The client issued a Encrypted Alert, which looks to have been > a Fatal one; it could have been after the server sent it's > SMTP-banner data (we can't be certain, again)
Handshake is definitely completed: last packet from server is pure Application Data, and its payload length (170) is very close to 146 bytes of 2-line SMTP banner (it should be slightly greater due to padding and hmac). So, client drops session just after reception of this banner. Running Exim with debug should confirm it. Removal of this 2-line banner seems to be a reasonable next step. -- Eugene Berdnikov -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
