On Fri, May 05, 2023 at 06:55:23PM -0500, E R via Postfix-users wrote: > postfix/smtpd[1234567]: SSL_accept error from xxx.xxx.xxx[yyy.yyy.yyy.yyy]: -1 > postfix/smtpd[1234567]: warning: TLS library problem: > error:03000098:digital envelope routines::invalid > digest:crypto/evp/m_sigver.c:343: > postfix/smtpd[1234567]: warning: TLS library problem: > error:0A0C0103:SSL routines::internal error:ssl/statem/statem_srvr.c:2684:
This problem may be worth further analysis. It appears that OpenSSL has chosen a signature algorithm (public key algorithm + digest method, e.g. RSA with SHA256, ...) at the TLS layer, but failed to initialise a signature context at the crypto API layer. This is odd, because the known TLS layer combinations should map to known crypto layer primitives. Are you on a RedHat system perhaps? RedHat's latest releases have turned up crypto policy to "11", and may refuse to, for example, support RSA with SHA1. The remote client may have one of the really dated TLS stacks that doesn't know how to do anything better. If your system is a RHEL or recent Fedora or similar system, or perhaps by now other distributions have joined the club, then you'll to find the relevant crypto policy file and dial it down a bit (on an MTA doing opportunistic TLS, RSA with SHA1 is better than cleartext). Similar considerations may apply not only to MTAs but also to validating DNS resolvers, and perhaps other applications. The various distributions may publish instructions on recommnded ways to tune the crypto policy. If all the above is false lead, then the problem is more mysterious, and perhaps a PCAP file capturing a failed handshake would be a good next step. You should of course also share (https://www.postfix.org/DEBUG_README.html#mail) $ postconf -nf $ postconf -Mf without any changes in whitespace, including line breaks. Attaching these as text files may be simplest if your mail client won't coöperate. -- Viktor. _______________________________________________ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org
