[Eisfair] E1: Umstellung auf SSL-Mail

[Marcus Roeckrath]

Hallo Holger,

Holger Bruenjes wrote:

>> SMTP_SERVER_TRANSPORT='both'
>> SMTP_SERVER_TLS_ADVERTISE_HOSTS='*.gmx.net'
> 
> 
> Wenn ich diese beiden setze, bekomme ich dieses zu sehen, mit gmx
> 
> 24891 SSL_connect succeeded
> 24891 Cipher: UNKNOWN:ECDHE-RSA-AES256-GCM-SHA384:256

Und jetzt lösche ich die pem-Datei für mail.gmx.net und bekomme immer noch
eine verschlüsselte Verbindung:

15174 Connecting to mail.gmx.net [212.227.17.190]:25 ... connected
15174 waiting for data on socket
15174 read response data: size=52
15174   SMTP<< 220 gmx.com (mrgmx001) Nemesis ESMTP Service ready
15174 212.227.17.190 in hosts_avoid_esmtp? no (option unset)
15174   SMTP>> EHLO eis.senden.germany
15174 waiting for data on socket
15174 read response data: size=107
15174   SMTP<< 250-gmx.com Hello eis.senden.germany [79.243.2.81]
15174          250-SIZE 69920427
15174          250-AUTH LOGIN PLAIN
15174          250 STARTTLS
15174 212.227.17.190 in hosts_avoid_tls? no (option unset)
15174   SMTP>> STARTTLS
15174 waiting for data on socket
15174 read response data: size=8
15174   SMTP<< 220 OK
15174 setting SSL CTX options: 0x1000000
15174 Diffie-Hellman initialized from default with 2048-bit prime
15174 Initialized TLS
15174 Calling SSL_connect
15174 SSL info: before/connect initialization
15174 SSL info: before/connect initialization
15174 SSL info: SSLv2/v3 write client hello A
15174 SSL info: SSLv3 read server hello A
15174 SSL info: SSLv3 read server certificate A
15174 SSL info: SSLv3 read server key exchange A
15174 SSL info: SSLv3 read server done A
15174 SSL info: SSLv3 write client key exchange A
15174 SSL info: SSLv3 write change cipher spec A
15174 SSL info: SSLv3 write finished A
15174 SSL info: SSLv3 flush data
15174 SSL info: SSLv3 read finished A
15174 SSL info: SSL negotiation finished successfully
15174 SSL info: SSL negotiation finished successfully
15174 SSL_connect succeeded
15174 Cipher: UNKNOWN:ECDHE-RSA-AES256-GCM-SHA384:256
15174   SMTP>> EHLO eis.senden.germany

Wie kann das ohne das passenden Zertifikat auf demeigenn Server überhaupt
sein?

-- 
Gruss Marcus