TLS + SMTP Error when using OTP/26

[fekle]

Describe the bug

Hi there, I'm not sure if i should open this issue in gen_smtp or here, but given that I'm using gen_smtp via Swoosh and Elixir its safer to start here.

I recently updated my Projects to Elixir 1.15 and OTP/26, and everything but sending emails via swoosh works fine.
I am sending E-Mails via SMTP, using a local business mail provider as a relay.

Swoosh tries sending the email multiple times and finally fails with the following error:

{:error,
 {:retries_exceeded, {:temporary_failure, ~c"XXX.XXX.XXX.XXX", :tls_failed}}}

Here is my configuration:

  config :redacted, REDACTED.Mailer,
    adapter: Swoosh.Adapters.SMTP,
    relay: System.get_env("SMTP_HOST") || raise("missing SMTP_HOST"),
    username: System.get_env("SMTP_USERNAME") || raise("missing SMTP_USERNAME"),
    password: System.get_env("SMTP_PASSWORD") || raise("missing SMTP_PASSWORD"),
    tls: :always,
    ssl: false,
    auth: :always,
    port: 587,
    retries: 15

The provider only supports STARTTLS via port 587, so that's why ssl is set to false.

With Elixir 1.15 on OTP/25 it worked fine, with OTP/26 the issue appears.

I checked the Erlang documentation, but there don't seem to be any breaking changes related to TLS apart from SSL certificate validation being on by default, but that should be fine? I know this is not much to go on, but unfortunately swoosh does not give me any more information apart from :tls_failed which makes this hard to debug.

Steps to Reproduce the Bug or Issue

Send an email via Swoosh's SMTP adapter and the aforementioned config with OTP/26.

Expected behavior

The email sends without issues.

Your reproducible example

No response

Screenshots or Videos

No response

Platform

• OTP: 26.0.2
• Elixir: 1.15.0

Additional context

No response

[princemaple]

{:retries_exceeded, {:temporary_failure, ~c"XXX.XXX.XXX.XXX", :tls_failed}} this is all that gen_smtp returned to Swoosh. There isn't much more we can provide either. I'll leave this open and see if others can provide solutions/workarounds.

[fekle]

@princemaple Yeah, i figured as much! Annoying that gen_smtp does not expose more information about this error.

[mihya]

I am having exactly the same error.
{:retries_exceeded, {:temporary_failure, ~c"XXX.XXX.XXX.XXX", :tls_failed}}
But, having my own smtp server, I was able to see the server logs (using postfix here):
warning: TLS library problem: error:0A00010B:SSL routines::wrong version number:ssl/record/ssl3_record.c:354:
So, obviously the wrong tls version is being used.

I tried to change the settings in option tls_version (to 'tlsv1.1', 'tlsv1.2' or 'tlsv1.3') but until now to no avail
More options can be found here:
https://www.erlang.org/doc/man/ssl.html#type-tls_options_name

[tosie]

Here is a working configuration for Microsoft365 servers:

config = [
  relay: "smtp.office365.com",
  port: 587,
  username: "...",
  password: "...",
  auth: :always,
  ssl: false,
  tls: :always,
  tls_options: [
   versions: [:"tlsv1.3"],
   verify: :verify_peer,
   cacerts: :public_key.cacerts_get(),
   server_name_indication: 'office365.com',
   depth: 99
  ],
  auth: :always,
  no_mx_lookups: false
]

Setting server_name_indication to 'office365.com' is very necessary (there seems to be a problem with the built-in hostname verification function not accepting *.office365.com as given in the server's certificate.

[fekle]

Maybe we should just use something like tls_certificate_check (https://hex.pm/packages/tls_certificate_check) to set tls_options using the relay domain by default if not specified?

For example:

tls_options: tls_options || :tls_certificate_check.options(relay)

That would have the least friction for users and would probably be how most users expect the library to behave - using the default CA certs and setting SNI to the same as the relay. Maybe add an additional, optional, SNI option to catch cases like @tosie mentions.

See: gen-smtp/gen_smtp#328

[tosie]

Just tested it with Microsoft365 and it works.

config = [
  relay: "smtp.office365.com",
  port: 587,
  username: "...",
  password: "...",
  auth: :always,
  ssl: false,
  tls: :always,
  tls_options: :tls_certificate_check.options("smtp.office365.com") ++ [versions: [:"tlsv1.3"]],
  auth: :always,
  retries: 0,
  no_mx_lookups: false
]

Thanks for mentioning tls_certificate_check, @fekle 👍

[Hermanverschooten]

I am running in the same issue, but I don't know how to translate the above mentioned solution into my config file.

[cescobaz]

Hello, same problem here and changing the tls_options doesn't help.

My postfix server logs:

warning: TLS library problem: error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:331

[fekle]

@cescobaz this looks like a problem with unsupported TLS versions? Or maybe your postfix expects a client hello with SSL3? You could try playing around with the versions options in tls_options.
Or maybe try using SSL instead of STARTTLS?

Anyhow I don't think this is really related to the certificate/host validation problems in this issue.

[mihya]

I could solve the issue by using the config file structure that tosie used in this message:
#785 (comment)
Thank you very much, tosie!

[cescobaz]

Ok, I finally got the working solution for me, I made mistake with the format of server_name_indication that must be a charlist

  tls_options: [
    versions: [:"tlsv1.3"],
    verify: :verify_peer,
    cacerts: :public_key.cacerts_get(),
    server_name_indication: ~c"#{System.get_env("SMTP_RELAY")}",
    depth: 99
  ],

Thanks everyone for helping!