Secure SMTP does not work

[Glow91]

I tried to configure the email part and as my provider only shows the secure stuff on the page my config looks like this:

email:
    smtp_host: "smtp.strato.de"
    smtp_port: 465
    smtp_user: "printer@mydomain.de"
    smtp_pass: "xxxxxxxxx"
    smtp_secure: true
    no_reply: "printer@mydomain.de"

It looks like there is an Problem with the secure connection because this config results in an error loke this:

2025-02-13T23:18:19.875Z [error]: Connection timeout Stack: Error: Connection timeout at SMTPConnection._formatError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:807:19) at SMTPConnection._onError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:793:20) at Timeout.<anonymous> (/app/node_modules/nodemailer/lib/smtp-connection/index.js:237:22) at listOnTimeout (node:internal/timers:581:17) at process.processTimers (node:internal/timers:519:7) {"code":"ETIMEDOUT","command":"CONN"}

After removing the smtp_secure property and set the port to 587 everything works fine.
For my usecase this ist just fine and I will use the unsecure connection, but maybe someone will have a look into it :)

[oschwartz10612]

HI!

Just curious are you sure that your SMTP provider supports secure on 465? It looks like it was trying to connect but timing out which may suggest that it is not supported?

Otherwise we will test and see if we can reproduce!

[Glow91]

HI,
I use the same SMTP Mail in my Bitwarden Instance and it works fine on port 465.

Let me know in case I can provide further information or semething else.

[zandercodes]

HI, I use the same SMTP Mail in my Bitwarden Instance and it works fine on port 465.

Let me know in case I can provide further information or semething else.

The question is, is it STARTTLS or just TLS.
These are two different protocols.
Which of these does not work?
If it is a self-signed mail server certificate, this will probably be the problem.

[tomasodehnal]

Checking with openssl the cert is trusted from public CA, doesn't seem this is the issue.

I have tested both SMTP connection options and they work fine with my server:

• SSL/TLS

  smtp_host: "smtp.purelymail.com"
  smtp_port: 465
  smtp_secure: true
  

• STARTTLS

  smtp_host: "smtp.purelymail.com"
  smtp_port: 587
  smtp_secure: false
  

When trying with incorrect credentials (just for the sake of the test) on smtp.strato.de, I don't get connection timed out but the expected auth failed:

pangolin  | 2025-04-05T08:22:00.187Z [error]: Invalid login: 535 5.7.8 Authentication failed: wrong user/password

@Glow91 Could you maybe try it once more? Looks like there was some temporary issue along the way.

[Glow91]

Sorry for the late answer. I found some time to check this again and got the same result.

I used this configuration:
email:
smtp_host: "smtp.strato.de"
smtp_port: 465 -- Commented to get it work again
smtp_user: "mymail@mydomain.de"
smtp_pass: "mypass"
smtp_secure: true -- Commented to get it work again
no_reply: "mymail@mydomain.de"

Here a link to Strato documentation --> https://www.strato.de/faq/mail/so-lauten-die-strato-e-mail-server/

[oschwartz10612]

We need to see if the machine/container running Pangolin can establish a basic TLS connection to Strato on port 465 without involving Pangolin's code. On shell inside the environment where Pangolin is running please try running the following command:

openssl s_client -connect smtp.strato.de:465 -crlf

What to look for:

Does it successfully connect and show certificate information, eventually saying something like 220 smtp.strato.de ESMTP RZmta ...? (You can type QUIT after it connects).

Or does this openssl command also hang or time out?

Please paste the output (or describe the result) here. This test bypasses Nodemailer and helps determine if the issue is at a lower network/TLS level within your Pangolin environment or if it's specific to how Pangolin/Nodemailer initiates the connection.

[Glow91]

Thanks for the quick response.
The mentioned command also leads to an timeout.
After some investigation I saw that my VPS Provider blocks some Ports because auf Spam protection and these Ports needs to be unlocked by request.

Im pretty sure after this is done there are no more issues.

Very sorry for wasting your time. But i appreciate your effort.
I will give final feedback after response from my VPS provider but from my side the issue can be closed.

(Edit): Port is now unlocked by my VPS Provider and everything works fine.
Thanks guys for this amazing piece of software ❤