Re: Cannot start TLS: handshake failure

2020-11-30 Thread Viktor Dukhovni
On Mon, Nov 30, 2020 at 04:44:17PM -0300, SysAdmin EM wrote: > It seems strange to me because the connection was working correctly and no > changes have been made to the settings. The *remote* server is malfunctioning, so your settings are largely irrelevant. > Here the configuration of the Exch

Re: Cannot start TLS: handshake failure

2020-11-30 Thread SysAdmin EM
Thanks for the reply. The configuration I am currently using is the following: smtp_tls_exclude_ciphers = MD5,SRP,PSK,aDSS,kECDH,kDH,SEED,IDEA,RC2,RC5,RC4 smtp_tls_protocols = !SSLv2:!SSLv3 smtpd_tls_cert_file = /etc/pki/tls/certs/linux.ferozo.com.pem smtpd_tls_key_file = /etc/pki/tls/private/lin

Re: Cannot start TLS: handshake failure

2020-11-30 Thread Viktor Dukhovni
On Mon, Nov 30, 2020 at 02:50:43PM -0300, SysAdmin EM wrote: > Nov 30 14:43:58 smarthost04-ded postfix-out/smtp[31323]: 0F6EE920CBC: > Cannot start TLS: handshake failure > Nov 30 14:43:58 smarthost04-ded postfix-out/smtp[31323]: 0F6EE920CBC: to=< > fvid...@exchange.infoauto.com.ar>, relay=exet02.

Re: (Cannot start TLS: handshake failure) - Please help

2017-03-27 Thread Viktor Dukhovni
> On Mar 27, 2017, at 1:09 PM, Mark Wise wrote: > > Really sorry. > http://postfix.1071664.n5.nabble.com/Postfix-cannot-start-tls-handshake-failure-td89684.html You'll need to join the postfix-users list via majord...@postfix.org, as explained at http://www.postfix.org/lists.html. I and other

Re: Cannot start TLS: handshake failure when relaying through Exchange 2007

2016-09-15 Thread fleon
Thank you Viktor, with your configuration changes now it works again! Indeed, Exchange is running on Windows Server 2003 R2 and an upgrade is overdue. After two years of delay, finally it will get upgraded in two months. -- View this message in context: http://postfix.1071664.n5.nabble.com/Cann

Re: Cannot start TLS: handshake failure when relaying through Exchange 2007

2016-09-15 Thread Viktor Dukhovni
On Thu, Sep 15, 2016 at 04:37:47AM -0700, fleon wrote: > After two years of successful emails sent by postfix through our exchange > 2007 server i have started having problems. I did update debian 7 to debian > 8, so i don't know what postfix/openssl version i had back then. In Debian 8 you have

Re: Cannot start TLS: handshake failure when relaying through Exchange 2007

2016-09-15 Thread fleon
For additional clarification, i was able to telnet to our exhange server and authenticate to it just fine: telnet mar-exch01 25 Connected to mar-exch01.mydomain.com. Escape character is '^]'. 220 mar-exch01.mydomain.com Microsoft ESMTP MAIL Service ready at Thu, 15 Sep 2016 08:21:03 -0400 EHLO 250

Re: Cannot Start TLS: handshake failure (openssl command succeed)

2015-05-20 Thread Christian Kivalo
On 2015-05-20 11:32, King Cao wrote: Dears, Hi, Currently my postfix need to delivery mails to exchange 2003 and encounter handshake failure issue when setting up the TLS connection. posttls-finger failed but openssl succeeded. The remote exchange only support cipher: "RC4-SHA". The "RC4-SH

Re: Cannot Start TLS: handshake failure

2015-05-01 Thread Tom Johnson
> On May 1, 2015, at 12:01 AM, Viktor Dukhovni > wrote: > > On Fri, May 01, 2015 at 04:51:03AM +, Viktor Dukhovni wrote: > >> For this server, you need a more "compact" cipherlist as a work-around. >> >> smtp_tls_exclude_ciphers = >> # >> # Disable MD5, DSA

Re: Cannot Start TLS: handshake failure

2015-05-01 Thread Viktor Dukhovni
On Fri, May 01, 2015 at 04:51:03AM +, Viktor Dukhovni wrote: > For this server, you need a more "compact" cipherlist as a work-around. > > smtp_tls_exclude_ciphers = > # > # Disable MD5, DSA, SRP and PSK, and the "exotic" fixed DH > cipher suites. >

Re: Cannot Start TLS: handshake failure

2015-04-30 Thread Viktor Dukhovni
On Thu, Apr 30, 2015 at 08:28:21PM -0700, Tom Johnson wrote: > > That aside, even with the "wrong" MX host, I still get successful > > connections. Perhaps you're behind some sort of firewall that > > proxies TLS and disconnects when it does not like the peer certificate: > > > > $ posttls-finge

Re: Cannot Start TLS: handshake failure

2015-04-30 Thread Tom Johnson
On Apr 230, 2015, at 2:41:53 PM, Viktor Dukhovni wrote: > > And I've tried this, thinking that it could be an issue with the selected > > ciphers, \ > > but it makes no difference: > > smtp_tls_exclude_ciphers = 3DES DES > > The symptom with broken 3DES with Microsoft systems is not a > hand

Re: Cannot Start TLS: handshake failure

2015-04-29 Thread Viktor Dukhovni
On Wed, Apr 29, 2015 at 05:57:36PM -0700, Tom Johnson wrote: > I have a basic postfix setup that's been working fine for a long time, > but recently, I've been seeing errors with a number of sites: > >"Cannot start TLS: handshake failure" > > Here are some specific sites where I'm seeing th