Re: disturbing TLS error

2013-09-15 Thread John Allen
I ran into a problem that seems to have some of the same attributes. In my case Google was rejecting my email, however they may have been a little more polite about doing so. Have you checked your DNS and reverse DNS entries. Is your server a dedicated system with a single IP address. In my

Re: disturbing TLS error

2013-09-15 Thread Wietse Venema
Mathieu R.: > As it seem to be a good advice, I did change my dns entries for > mx to mail.effraie.org, wich is covered by the (new) cacert > certificat of the mail server. > > I still have the same error in logs It does not matter what the server certificate says, because it is never sent. The

Re: disturbing TLS error

2013-09-15 Thread Mathieu R.
James Cloos a écrit : >The mx lookup on effraie.org returns mx.effraie.org. The cert >mx.effraie.org sends has a number of dnsnames, but not mx.effraie.org. > >I bet that is why the session failed. > >The mx for 400iso.net, mx.400iso.net, sends the same cert and also >likely will fail tls negoti

Re: disturbing TLS error

2013-09-15 Thread Viktor Dukhovni
On Sun, Sep 15, 2013 at 03:31:38PM -0400, James Cloos wrote: > The mx lookup on effraie.org returns mx.effraie.org. The cert > mx.effraie.org sends has a number of dnsnames, but not mx.effraie.org. > > I bet that is why the session failed. I noticed this, but I thought it unlikely that a sender

Re: disturbing TLS error

2013-09-15 Thread James Cloos
The mx lookup on effraie.org returns mx.effraie.org. The cert mx.effraie.org sends has a number of dnsnames, but not mx.effraie.org. I bet that is why the session failed. The mx for 400iso.net, mx.400iso.net, sends the same cert and also likely will fail tls negotiation with some senders. In ge

Re: disturbing TLS error

2013-09-14 Thread Viktor Dukhovni
On Sat, Sep 14, 2013 at 08:45:05AM +0200, Mathieu R. wrote: > >Yahoo sends "STARTTLS", Postfix says "go ahead" and Yahoo > >disconnects. > >There's is nothing more to it. Some strange problem on the Yahoo > >side, unless your firewall is blocking the handshake. > > My firewall is not doing such

Re: disturbing TLS error

2013-09-14 Thread Jan P. Kessler
> So, there is nothing i can do ? If you don't need TLS for yahoo you can disable it for that server. Take a look at http://www.postfix.org/postconf.5.html#smtpd_discard_ehlo_keyword_address_maps

Re: disturbing TLS error

2013-09-13 Thread Mathieu R.
Le 14/09/2013 03:23, Viktor Dukhovni a écrit : On Fri, Sep 13, 2013 at 11:51:39PM +0200, Mathieu R. wrote: not very much more : Sep 13 23:33:09 effraie01 postfix/smtpd[25221]: connect from ng4.bullet.mail.bf1.yahoo.com[98.139.164.99] Sep 13 23:33:44 effraie01 postfix/smtpd[25221]: SSL_accept e

Re: disturbing TLS error

2013-09-13 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 11:51:39PM +0200, Mathieu R. wrote: > not very much more : > > Sep 13 23:33:09 effraie01 postfix/smtpd[25221]: connect from > ng4.bullet.mail.bf1.yahoo.com[98.139.164.99] > Sep 13 23:33:44 effraie01 postfix/smtpd[25221]: SSL_accept error > from ng4.bullet.mail.bf1.yahoo.co

Re: disturbing TLS error

2013-09-13 Thread DTNX Postmaster
On Sep 13, 2013, at 23:51, Mathieu R. wrote: > Le 13/09/2013 23:26, Viktor Dukhovni a écrit : >> If your traffic volume is not too heavy, you can temporarily raise >> the Postfix SMTP server TLS log level to "2": >> >> smtpd_tls_loglevel = 2 >> >> this will show more details of the TLS han

Re: disturbing TLS error

2013-09-13 Thread Mathieu R.
Le 13/09/2013 23:26, Viktor Dukhovni a écrit : On Fri, Sep 13, 2013 at 11:03:22PM +0200, Mathieu R. wrote: >There is generally more information in the log than this when the >TLS handshake fails. DO NOT over-summarize the logs. Sep 13 22:58:40 effraie01 postfix/smtpd[22230]: SSL_accept error

Re: disturbing TLS error

2013-09-13 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 11:03:22PM +0200, Mathieu R. wrote: > >There is generally more information in the log than this when the > >TLS handshake fails. DO NOT over-summarize the logs. > > Sep 13 22:58:40 effraie01 postfix/smtpd[22230]: SSL_accept error > from ng4.bullet.mail.bf1.yahoo.com[98.13

Re: disturbing TLS error

2013-09-13 Thread Mathieu R.
Le 13/09/2013 22:29, Viktor Dukhovni a écrit : On Fri, Sep 13, 2013 at 09:44:38PM +0200, Mathieu R. wrote: Sep 13 21:31:34 effraie01 postfix/smtpd[12650]: SSL_accept error from ng17.bullet.mail.bf1.yahoo.com There is generally more information in the log than this when the TLS handshake fails

Re: disturbing TLS error

2013-09-13 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 09:44:38PM +0200, Mathieu R. wrote: > Sep 13 21:31:34 effraie01 postfix/smtpd[12650]: SSL_accept error > from ng17.bullet.mail.bf1.yahoo.com There is generally more information in the log than this when the TLS handshake fails. DO NOT over-summarize the logs. > (ever fro