Cannot send mail to certain recipients. SMTP STARTTLS failure (8922)

Anders Gustafsson

1 Likes

over 3 years ago

Symptoms

Cannot mail certain recipients. The sender sees this in the GW Client:

The reason given for the delay: 420 TCP write error

The following is shown in the GWIA log:

07:11:54 2323 DMN: MSG 2815270 Attempting to connect to mail12.surftown.se 07:11:54 2323 DMN: MSG 2815270 Connected to [212.97.132.52] (mail12.surftown.se) 07:11:54 2323 DMN: MSG 2815270 SMTP STARTTLS failure (8922) 07:11:55 2323 DMN: MSG 2815270 SMTP session ended: [212.97.132.52] (mail12.surftown.se)

Diagnosis

The best way to troubleshoot this would be to get a packet trace. On the GWIA server:

tcpdump -i any -s 0 -w /root/surftown.cap host 212.97.132.52

This will capture data just for that ip. Note that you cannot filter on a single IP if the recipient has multiple ones.

Open the packet trace in Wireshark. Look at the client and server hellos:

Client Hello. That is you:

You are indicating that you support TLS up to 1.2. Ideally the receiving mailserver should use that version, but instead:

Here the receiving mailserver uses TLS 1.0 and that protocol is regarded as unsecure and was deprecated in June 2018. GW 18.2 will not talk to him.

Solution

Ask the admin of the receiving mailserver to upgrade to a supported version of SSL

Labels:

How To-Best Practice

Comment List

Laura Buckley over 4 years ago

Thank you for the reminder Massimo.

https://support.microfocus.com/kb/doc.php?id=7024361
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
mrosen over 4 years ago

Thanks Laura, this is a workaround (am I right there is not yet a TID containing this?).
But the fact remains that even under the original configuration, GWIA is supposed to fallback to unencrypted transfer when starttls doesn't succeed, and itdoesn't. This should be looked at, regardless what the cause for the failure in STARTTLS negotiation is.
Simply not sending the mail is wrong, and on top, pointlessly deferring and retrying it (420 Error as a final result) is yet another mistake in the code.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
mrosen over 4 years ago

Sorry, this is a bug. Groupwise is supposed to fallback to plaintext (unless TLS/SSL is set to mandatory, which it virtually never is), and it doesn't.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
Laura Buckley over 4 years ago

Add this to the GWIA 18.2 startup file:

--sslOption "SSL_OP_ALLOW_TLSv1_1,SSL_OP_ALLOW_TLSv1"
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel

Recommended

Menu

GroupWise Tips & Information

Cannot send mail to certain recipients. SMTP STARTTLS failure (8922)

Symptoms

Solution

Labels:

Resources