Issues Sending to Gmail.com

get-help
1

REMOVED PRIVATE INFO

3

When using tls_prefer_openssl = true it attempts to connect to Gmail with an IPv6 address even though I don’t have one configured.

4

Yes. You probably want to skip IPv6 hosts

5

Yep, I am trying that out right now

6

No good

7 
kumo.on('get_egress_path_config', function(domain, source_name, site_name)
  return kumo.make_egress_path {
    enable_tls = 'OpportunisticInsecure',
    tls_prefer_openssl = true,
    skip_hosts = { '::/0' },
  }
end)
8

Removed private info

9

Okay, yeah.. We still see the OpenSSL issue, but with IPv4 addresses this time.

10

Let me try some other stuff

11

Okay, this is weird

12

With OpenSSL, there are no issues with TLS v1.2, but Gmail is using TLS v1.3 and is having trouble with it. I even tried using a very, very relaxed cipher set.

kumo.on('get_egress_path_config', function(domain, source_name, site_name)
  return kumo.make_egress_path {
    enable_tls = 'OpportunisticInsecure',
    tls_prefer_openssl = true,
    openssl_options = "ALL",
    openssl_cipher_list = "ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!RC4:!MD5:!PSK:!SRP:@SECLEVEL=1",
    openssl_cipher_suites = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_128_CCM_8_SHA256",
    skip_hosts = { '::/0' },
  }
end)
13

Let me check my OpenSSL version

14

OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

15

I just used this to connect to Gmail with no issues.

16 
subject=CN = mx.google.com
issuer=C = US, O = Google Trust Services, CN = WR2
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 5027 bytes and written 378 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
17

You may need to specify the file location for your cert.
from the November release notes:
The SMTP client will now look for the system CA-certificate bundle when making connections. If no CA-certificate bundle is present, it will have no available trust store and will not be able to successfully establish TLS sessions. Previously, we used a bundled hard-coded, non-extensible, copy of the Mozilla CA certificate store. You must therefore ensure that you install the ca-certificates package for your system, or otherwise contrive to populate the system certificate store.

18

Let me check

19

ca-certificates are already installed

20 
ca-certificates is already the newest version (20240203~22.04.1).
21

Weird. It does seem like the cert is either invalid or not accessible. Maybe check your permissions? It’s hard to tell without seeing your full configs