Re: It's normal that mail server use expired certs?

---=Part.6a8.26904efe1f7c87f9.198db022826.cb6291974b48c25b=-
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Accept-Language: fr-FR, en-US, vi-VN, ru-RU, ar-TN, it-IT, de-DE
Content-Language: en-US

Hello everybody

I am late to jump on that thread, sorry=2E (I enjoyed rela=
xng vacations that I much much needed!)

Disclaimer: At LINAGORA we do not =
use James for out deliveries, we tend to rely on Postfix for it=2E This ser=
ved us well (we have big infra and using James solely as a MDA is ok)=2E Bu=
t this means we do not have much expertise running James as a Mail Relay Ag=
ent=2E

I read the thread in diagonal and I am sadned the conclusions are:
=
=C2=A0- run unsecure options with clear mail traffic or
=C2=A0- do unlimite=
d bureaucracy while suffering delivery failures visible to the user with no=
 certainty of success

I believe there's a 3rd way: being able to relax (mo=
re than today) the certificate validation=2E

I drafted quickly a proposal =
of customizing the SSL context and its trust manager

CF=C2=A0https://githu=
b=2Ecom/apache/james-project/pull/2788=C2=A0

I am happy if people can give=
 this a try and provide feedback=2E

Cheers all=2E

--=C2=A0

Best regards,=


Benoit TELLIER

General manager of Linagora VIETNAM=2E
Product owner for =
Team-Mail product=2E
Chairman of the Apache James project=2E

Mail: btellie=
r@linagora=2Ecom
Tel: (0033) 6 77 26 04 58 (WhatsApp, Signal)


On Aug 24, =
2025 2:24 AM, from Cryptearth <cryptearth@cryptearth=2Ede=2EINVALID>Hey Iva=
n,

welcome to Apache James=2E

There's actually a very recent topic about =
that very issue: 
mail-archive=2Ecom/server-user@james=2Eapache=2Eorg/msg17=
186=2Ehtml
In the end it comes down to: James lacks the ability to perform =
a 
non-TLS retry when outgoing StartTLS is enabled and it fails due to some=
 
TLS ALERT (like the issues you mentioned)=2E

Recommendations?
If you pro=
vide others with your service it's your job to make sure your 
users mails =
get to thier targets=2E Using James the option is to disable 
outgoing Star=
tTLS and just don't bother with it=2E
A more sophisticated approach would b=
e to figure out 
hostmaster/postmaster contact info and try to reach out fo=
r the 
postmaster in charge to inform them about the issue=2E But depending=
 on 
how many you have to deal with this can take up hours=2E

If you're li=
ke me and just use your domain and server for your very self 
- well, then =
just ditch them=2E If they don't get thier shit in order why 
bother to dea=
l with them?

Unfortunately this is kinda of those "it depends" sitations: =
Following 
good code it's your responsibility to at least try to reach out =
to those 
in charge at least try to inform them=2E But if there's no other =
way (like 
the hostmaster/postmaster contact info lead to nowhere or just b=
ack to 
where you came from) and even try to contact them by classic physic=
al 
letter fails then there's not much you can do=2E

As an example: As I h=
ave a =2Ede domain it's registered by the german 
authority DeNIC=2E My act=
ual registrar is InterNetworX=2E I've set them as 
my hostmaster=2E So when=
 you do a whois on DeNIC and click on "technical 
contact" you get hostmast=
er@inwx=2Ede=2E At inwx there's my gmail=2Ecom mail 
address registered=2E =
So if anyone has issues with reaching me via e-mail 
they can contact my re=
gistrar and request them to contact me=2E
You have a mexican domain=2E Your=
 registrar seems to be HOSPEDANDO=2EMX=2E And 
although I wasn't able to fi=
nd a hostmaster contact I figured they use 
cloudflare=2E So in the end if =
I have trouble to contact you via e-mail 
because your mail server acts up =
I could try to contact cloduflare for 
the hospedando hostmaster or the mex=
ican authority nic=2Emx=2E And although 
none of them would hand me out any=
 information about you as I'm not a 
three-letter "men's club" based in the=
 usa I can request them to try to 
contact you via other means and inform y=
ou: "Hey, we got information 
that you messed up your mail server and this =
guy from germany can't send 
you mails=2E Fix that please=2E"=2E Hence I re=
commend have some global 
reachable contact like a gmail or similar with yo=
ur registrar=2E
That's how it's supposed to work=2E How much effort you put=
 into all of 
this - well, that's up to you=2E


So long =2E=2E=2E

Matt

A=
m 23=2E08=2E25 um 18:43 schrieb Ivan Perales:
> I am new to manage a mail s=
erver, but since i am a java programmer i 
> wanted a software that were ea=
sly to adapt to my needs, so when i 
> found apache james it fits like a gl=
ove=2E
>
> So in my journey to set it in prod mode i found a lot of problem=
s 
> which i could resolve, for example (understad that i was new) SFP, 
> =
DKIM, setting correct ehlo name and similars=2E But the ones i am no 
> sur=
e if have to resolve on my side are those ones involved with TLS 
> communi=
cation=2E My servers logs different fails like:
>
> =C2=A0* unable to find =
valid certification path to requested target
>
> * Can't verify identity of=
 server: <domain server here>
>
> * Certificate expired
>
> Checking those =
certs on the target mail server i found that they are 
> to old, or self si=
gned, that of course means a configuration problem, 
> but they're been run=
ning for months even years, if they wouldn't had 
> receiving mails they wo=
uld had correct it, right? so in order for them 
> to keep that bad config =
means other server by passes those native cert 
> restrictions and send ema=
ils anyway=2E
>
> So my question is=2E=2E do i need to=C2=A0 do that too? t=
his would mean to 
> avoid the nature of certs, so if this has to be this w=
ay, why concern 
> about implementing TLS? just for encryption? I set the r=
emote delivery 
> config of verifyServerIdentity to false to bypass one kin=
d of error, 
> but what about the others? What do you recommend me to do?
>=

>
> Thanks for your time=2E
>


------------------------------------------=
---------------------------
To unsubscribe, e-mail: server-user-unsubscribe=
@james=2Eapache=2Eorg
For additional commands, e-mail: server-user-help@jam=
es=2Eapache=2Eorg



---=Part.6a8.26904efe1f7c87f9.198db022826.cb6291974b48c25b=---