[Bug]: SMTP relay fails to connect to Prontonmail bridge

[mpclepto]

Describe the issue

While using the Proton mail bridge, ABS is unable to send emails via SMTP.

Steps to reproduce the issue

1. Install / configure protonmail bridge app on unraid
   (configuration is known good as other apps (Ombi / overseer) function with the bridge)
2. install / configure ABS to point to the mail bridge (whether "secure" or "insecure" is selected, neither function)
   (mail bridge config is known good as other services can send mail through it such as Ombi or Overseerr)
3. receive the following log error while "secure" is selected in ABS:

[2024-03-18 15:19:39.116] INFO: [EmailManager] Sending test email
[2024-03-18 15:19:39.160] ERROR: [EmailManager] Failed to verify SMTP connection config [Error: B8ECF7BE60140000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:
] {
library: 'SSL routines',
reason: 'wrong version number',
code: 'ESOCKET',
command: 'CONN'
} (EmailManager.js:17)

3. receive the following log error while "insecure" is selected in ABS:

[2024-03-18 15:24:01.008] INFO: [EmailManager] Sending test email
[2024-03-18 15:24:01.059] ERROR: [EmailManager] Failed to verify SMTP connection config Error: self-signed certificate
at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
at TLSSocket.emit (node:events:518:28)
at TLSSocket._finishInit (node:_tls_wrap:1085:8)
at ssl.onhandshakedone (node:_tls_wrap:871:12) {
code: 'ESOCKET',
command: 'CONN'
} (EmailManager.js:17)

With ABS, I am able to send emails to the Gmail SMTP gateway with no issues. I'm not entirely certain what the correct fix is here, but seeing as how this is entirely internal to my own network, I would be happy with a "allow self-signed cert" if that fixes the issue. Thanks in advance!

Audiobookshelf version

v2.8.1

How are you running audiobookshelf?

Docker

[advplyr]

Are you still having this issue? What port are you using?

[mpclepto]

Yes this is still an issue and it is using port 25 for the protonmail bridge.

[advplyr]

Have you tested with leaving secure toggled off? I read that the package we are using doesn't want that set for other ports which I updated for the next release but you can test now.

[mpclepto]

I have tested with secure off and it still has the same failure.

[0xGingi]

I'm using ProtonMail SMTP Tokens rather than the bridge, but with secure on it doesn't work for me neither.

Turning secure off fixed it for me

With Secure On:
[EmailManager] Failed to verify SMTP connection config Error: C8912DC2777F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:

[advplyr]

Thanks for confirming. I have this fixed for the next release

[advplyr]

Fixed in v2.10.0

[jecpr]

I am still having this issue after the fix.
Current version 10.0.1. Running proton mail bridge and have verified i can connect and authenticate. Proton serves smtp on port 1025. I have tried with both secure selected and not.
Log output when secure not selected:

[2024-05-29 20:27:05.018] INFO: [EmailManager] Sending test email
[2024-05-29 20:27:05.024] ERROR: [EmailManager] Failed to verify SMTP connection config Error: self-signed certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
    at TLSSocket.emit (node:events:519:28)
    at TLSSocket._finishInit (node:_tls_wrap:1085:8)
    at ssl.onhandshakedone (node:_tls_wrap:871:12) {
  code: 'ESOCKET',
  command: 'CONN'
} (EmailManager.js:17)

and with secure:

[2024-05-29 20:27:51.521] INFO: [EmailManager] Sending test email
[2024-05-29 20:27:51.527] ERROR: [EmailManager] Failed to verify SMTP connection config Error: self-signed certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
    at TLSSocket.emit (node:events:519:28)
    at TLSSocket._finishInit (node:_tls_wrap:1085:8)
    at ssl.onhandshakedone (node:_tls_wrap:871:12) {
  code: 'ESOCKET',
  command: 'CONN'
} (EmailManager.js:17)

Is there a way to tell it to not validate the ssl cert for the email?

Many thanks in advance!

[0xGingi]

@advplyr I may be wrong, but since audiobookshelf uses nodemailer, there could easily be either a existing check on the SMTP cert or an additional toggle to add "rejectUnauthorized: false" in the createTransport to allow self-signed certs

[jecpr]

Yep, so I think a reasonable fix might be to include the following in the getTransportObject within /server/objects/settings/EmailSettings.js:

payload.tls = {
    rejectUnauthorized: false
  }