Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

We do not need to verify the certificate for smarthost #339

Merged
merged 1 commit into from Jun 3, 2021

Conversation

stephdl
Copy link
Contributor

@stephdl stephdl commented Jun 1, 2021

We have a case where the certificate is not trusted by curl, we could avoid to verify the certificate before to send a test email (smarthost validation)

https://community.nethserver.org/t/sending-system-mails-over-an-other-server/18353/40

with this PR we skip the cert verification, we can find this

> STARTTLS
< 220 2.0.0 Ready to start TLS
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

instead of

> STARTTLS
< 220 2.0.0 Ready to start TLS
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

The command for QA is

echo '{"action":"test-smarthost","SmartHostName":"smtp.domain.com","SmartHostPort":"587","SmartHostUsername":"stephane@domain.com","SmartHostPassword":"azerty","SmartHostTlsStatus":true}' | /usr/bin/sudo /usr/libexec/nethserver/api/system-settings/execute | jq

NethServer/dev#6516

@nethbot
Copy link
Member

nethbot commented Jun 1, 2021

in 7.9.2009/autobuild:

@stephdl stephdl requested a review from gsanchietti June 2, 2021 14:56
Copy link
Member

@gsanchietti gsanchietti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, certificate check shot not be needed here

Still, I would like a review also from @DavidePrincipi

Copy link
Member

@DavidePrincipi DavidePrincipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree to disable the certificate check because if that check fails Postfix does not use TLS at all.

@stephdl stephdl merged commit 8228906 into NethServer:master Jun 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants