Re: SNI on STARTTLS in mailfront

Hi John,

Thanks a lot for taking time to reply.

On 2019-02-08 09:08, John R. Levine wrote:
> Hard to say.  It works fine on my FreeBSD system, and I can't think of
> any obvious differences between BSD and Centos.  I assume you've
> checked the directory and file permissions, and your mailfront daemon
> can read both the .crt and the .key files?

There is no permission and/or ownership issues related to those 
.crt/.key files as one of my testing is to set TLS_CERTFILE/TLS_KEYFILE 
to the same SNI cert/keyfile.

Once again, thanks.

Kindest regards,
Giam Teck Choon

> 
>> I used your starttls-gnutls.c and encountered problems when 
>> TLS_CERTDIR is set and regardless SNI cert/key file exists will show 
>> the following errors:
>> 
>> The below error suppose to use the default TLS_CERTFILE and 
>> TLS_KEYFILE when SNI cert/key files not found:
>> 
>> @ 400000005c5bdf89185de07c mailfront[20072]: Starting TLS handshake
>> @ 400000005c5bdf89185df7ec mailfront[20072]: No SNI in request, using 
>> default certificate
>> @ 400000005c5bdf89185dffbc mailfront[20072]: TLS handshake failed: 
>> Could not negotiate a supported cipher suite.
>> 
>> The below error suppose to use the SNI cert/key files (when exists) 
>> when TLS_CERTDIR is set. I patched your starttls-gnutls.c to show the 
>> SNI key/cert files:
>> 
>> @ 400000005c5bdf91377adf8c mailfront[20075]: Starting TLS handshake
>> @ 400000005c5bdf9137d23ad4 mailfront[20075]: Using SNI cert/key file 
>> for rat.choon.net
>> @ 400000005c5bdf9137d24a74 mailfront[20075]: SNI certfile 
>> /var/qmail/ssl/rat.choon.net/rat.choon.net.crt for rat.choon.net
>> @ 400000005c5bdf9137d25244 mailfront[20075]: SNI keyfile 
>> /var/qmail/ssl/rat.choon.net/rat.choon.net.key for rat.choon.net
>> @ 400000005c5bdf9137d25a14 mailfront[20075]: TLS handshake failed: 
>> Could not negotiate a supported cipher suite.
>> 
>> If TLS_CERTDIR not set then everything working to use TLS_CERTFILE and 
>> TLS_KEYFILE.
>> 
>> System is CentOS 7. openssl version/release is 1.0.2k-16.el7 and 
>> gnutls version/release is 3.3.29-8.el7.
>> 
>> Thanks for file and any suggestions I can get to make SNI work in my 
>> system.
>> 
>> Kindest regards,
>> Giam Teck Choon
>> 
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>> 
>> 
>> 
> 
> Regards,
> John Levine, [email protected], Primary Perpetrator of "The Internet for 
> Dummies",
> Please consider the environment before reading this e-mail. 
> https://jl.ly
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]