Incoming STARTTLS not showing/working, though outbound works just fine

Question

In preparation for Google's change of mandating TLS to accept messages as of 2024-02-01 (February 1st, 2024) 
 SMG 23.3.4 rpm:1.0.1-496.1 
 Getting the TLS settings for SMG working, and have it working just fine now for sending to GMail as I finally can find TLS in the message header as seen in "Original Message" in GMail. 
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); 
 I think I have all the correct settings as per the rather sparse documentation. Or is it being picky about the eDir generated/Issued certificate?

marvhuffaker · Accepted Answer

Thank you! The problem was: - External Delivery, Connection Security to Auto. 
 That seems like a redundant, unnecessary, useless, unessential, unneeded, repetitive, superfluous and not required setting. 
 I had been monitoring the logs very carefully which is why I knew starttls wasn't even trying. 
 I'm getting this now in my headers to gmail, so it's a success: 
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thanks again! (I posted a reply previously and got flagged for having "forbidden words" in my response. lol. I appealed that, so if another similar reply shows up, that's why). I'm not sure what the bad words were.

AndrewFerris · Answer

All right I got it working. The trick was to SSL *GWIA* and then SMG works both ways. A big pointer in that direction was the "Test" button inside Domain Management --> Manage Domains --> my Domain as it showed SMG trying to starttls with GWIA.

Andy Konecny · Answer

Success! 
 A) the undocumented cert needs of SMG, are to be a non-binary type. The docs indicate a .crt file, but that is very none specific about this. Base64 encoded is what is needed, and SMG doesn't appear to care about the actual extension (I left it as .b64 that iManager does when you tell it Base64 rather than the default binary DER for encoding this X.509 Certificate) openssl to generate the csr, iManager, NetIQ Certificate Server, Issue Certificate, Key Type: SSL or TLS, next to step 4 where to be sure add your FQN(s) of the SMG box, possible crank that validity past 2 years, Save to: File in Base64 format, and remember to "Download the issued certificate." while the option is there. B) have to remember (for every new test cert) that the certificate files in /vastorage/smg/certs must be chowned as smg:smg Troubleshooting tips for "Does SMG like my certificate" the log to look at is /vastorage/smg/services/logs/smg-smtp-*/currentdate.log so as a quick way to get the SSL server status, from that folder # grep -b5 "Starting SMTP SSL server" *.log If failing, you will see these in that results ... (CORE) (E#31) SSL failed to initialize ... (CORE) (E#31) SSL failed to initialize ... (CFSV) SSL failed to initialize, TLS is disabled success being none of those before ... (CFLD) Configuration load complete And a final check is the telnet to it on port 25, and quickly follow up to its prompt with "ehlo {hostURcomingFromFQN}" that you should have in your clipboard before launching the telnet. Then you should see the STARTTLS in the options available. quit to exit the telnet session if it doesn't time out quickly. With other tips in this thread such as ALL the spots to tell it is actually encrypt the mail, not just turn on TLS/SSL and not actually use it. 
 Thank you all in the journey intertwined with all the other stuff on the go.

Menu

SMG User Discussions

Verified Answers

Incoming STARTTLS not showing/working, though outbound works just fine

Top Replies

Resources