ERROR: error reading: received fatal alert: UnknownCA

get-help
1

Having an issue, not quite certain what it is..

[x.x.x.x:3852->y.y.y.y:25] 265ms === ERROR: error reading: received fatal alert: UnknownCA
[38.74.128.59:3852->108.181.135.169:25] 265ms === Closed```
2

Hey there @poised-goat, thanks for posting. Please read the “Troubleshooting” and “How to Ask for Help” buttons below. If you would like a 1:1 support session from the KumoMTA team, details are at the “Book a Support Session” button below.

3

I bet my self-signed certificate is done wrong

4

SWAKs on a remote system was able to work though, but maybe SWAKs didn’t care and this system does?

5

hmm. I redid the Creating a Self-Signed Certificate from the tutorials section, and am still getting that error…

6

so what I’m wondering, is if the SENDING system has some kind of funky TLS certain, and that’s Kumo complaining about receiving it

7

currently trying to get trace-smtp-server to be even more verbose. it looks like that error is in a Rust Library, but that you can get it to give you more info sometimes

8

Check permissions on that cert. most of the time we see SSL issues, it is permissions on the file

9

I think I wrote up a bit on that in the tutorial.

10

I don’t see that in this section: https://docs.kumomta.com/tutorial/system_preparation/?h=certi#creating-a-self-signed-certificate

but I’ll check if I can find somewhere else talking about SSL permissions

11

it would be nice if that was the issue :slightly_smiling_face:

12

Hmmm. Yeah I see that. Gimme a minute to see

13

it appears to be an INBOUND issue coming from the platform (think mautic/ongage/etc. this is private unreleased one yet. though I just got them to agree to integrate Kumo :wink: )

14

at least I think that’s the issue based on trace-smtp-server

15

I just did a swaks thest with --tls and it worked fine

16

so my guess is that the platform’s server is failing it’s Certificate check with Kumo…which is a bit weird and what I’d like to get to be more verbose so I can figure out where/why and let them know what to fix

17

it’s late for you though, so please feel free to ignore me if nothing’s sticking out immediately :slightly_smiling_face:

18

Hmm. You know I saw that with another injector that was not handling STARTTLS properly ( strangely a common issue)

19

I was able to show that with kcli

20

^^I’m wondering if there’s a way to get that even MORE verbose. what I pasted on the first message was all I got from kcli trace-smtp-server