Re: ucspi-tls (attn: Scott Gifford)

Josh Trutwin <[email protected]> writes:

[...]

> So my run file for qmail-smtpd should not use tcpserver, but use
> sslserver for all connections and with -w.  

Right.

[...]

> This works for STARTTLS and vanilla SMTP.  For STARTTLS though I still
> get the following warning:
>
> @40000000429f3189285946ec sslserver: warning: dropping connection,
> unable to speak SSL: error:00000005:lib(0):func(0):DH lib
>
> Is this anything to be concerned with?

I'm not sure; it doesn't look good, but it's not specific enough to
know exactly what's going on.

See if you get the error when you test with stunnel; with stunnel 3, I
use something like:

    ./stunnel -D debug -n smtp -f -c -r mail.actionwebservices.com:25

If you don't see the error with that, it's a client-specific problem.

Another thing to try is use an unpatched sslserver on port 465, and
see if you get the same error.  If you do, it's not a problem with the
patch, but something with sslserver, and the sslserver mailing list
can probably help.  If it only happens with my patch, I'll need to
take a closer look and see if I can reproduce it.

[...]

> FYI, the patch doesn't apply cleanly to mailfront-0.94:

Thanks, I'll update it as soon as I have a bit of time available.

---ScottG.

-- 
Scott Gifford
Help us find a cure for cancer!
American Cancer Society Relay for Life - http://www.suspectclass.com/relay4life/