SMTP: Java protocol issues ...

[mave-git]

Hi, this is my first contact to and with alfi.io, trying and looking at it.

Installation is on cloud server (Hetzner), vserver Ubuntu 20.04 (4GB RAM, 40GB disk), running 2.0-M3-2107 (2021-07-04), Obenjdk-11. Seems to be fine, but:

no (smtp) mail is going out. I tried an own mail server (mail-in-a-box), posteo.de, hetzner-mail-server. Port 465, 587, smtp, smtps, even in smtp properties "mail.smtp.starttls.enable=true"; did made changes/playing in java.security activating TLSv1x ... nothing worked:

Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:170) ~[?:?]
        at sun.security.ssl.ClientHandshakeContext.<init>(ClientHandshakeContext.java:98) ~[?:?]
        at sun.security.ssl.TransportContext.kickstart(TransportContext.java:221) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:433) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:411) ~[?:?]
        at com.sun.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:527) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.util.SocketFetcher.startTLS(SocketFetcher.java:464) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:1902) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:666) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at javax.mail.Service.connect(Service.java:295) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at org.springframework.mail.javamail.JavaMailSenderImpl.connectTransport(JavaMailSenderImpl.java:518) ~[spring-context-support-5.2.5.RELEASE.jar!/:5.2.5.RELEASE]
        at org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:437) ~[spring-context-support-5.2.5.RELEASE.jar!/:5.2.5.RELEASE]

Sometimes: "could not connect to server XY on Port 587 or 465 ...

Any issues known?

Regards!

Desktop (please complete the following information):

• OS: Ubuntu 20.04
• Browser: Firefox, Browser
• Version: newest

Additional context Server: Ubuntu Server 20.04, installed PostgreSQL (working), Obenjdk-11

[ken-bem]

Maybe this could help you: https://stackoverflow.com/questions/67899129/postfix-and-openjdk-11-no-appropriate-protocol-protocol-is-disabled-or-cipher

[mave-git]

Thanks! This Java stuff is sobering ... ;-). No success. At https://alf.io/docs/getting-started/e-mail/smtp/ there is a link to "More details on what properties you can change, and the syntax for changing them is here", but what is the right syntax using inside the Alfi.io-Configuration GUI? For example:

props.put("mail.smtp.ssl.protocols", "TLSv1.2") to force using TLSv1.2

Should it in the textbox like above, or "mail.smtp.ssl.protocols", "TLSv1.2" or mail.smtp.ssl.protocols, TLSv1.2 or ....?

Whatever I set, no mails are going outside. Either it is wrong protocol, or something like Failed messages: javax.mail.MessagingException: Could not connect to SMTP host: my.box2mail.de, port: 465, response: -1 (in this case my.box2mail.de is a used and working mail server).

Regards

[cbellone]

Hi,

can you please attach the whole stack trace that you have in the logs?

what is the right syntax using inside the Alfi.io-Configuration GUI?

mail.smtp.ssl.protocols=TLSv1.2

back to the certificate, it appears that the host you're trying to connect to doesn't have a valid certificate:

$ openssl s_client -connect my.boxmail.de:465
CONNECTED(00000003)
depth=2 C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
verify return:1
depth=1 C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Domain Validation CA SHA2
verify return:1
depth=0 CN = *.kasserver.com
verify return:1
---
Certificate chain
 0 s:CN = *.kasserver.com
   i:C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Domain Validation CA SHA2
 1 s:C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Domain Validation CA SHA2
   i:C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA

IMO this should return a valid certificate for my.boxmail.de. Instead it is returning a wildcard certificate for another domain.

for reference, here's the output for smtp-relay.gmail.com:

$ openssl s_client -connect smtp-relay.gmail.com:465
CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = smtp-relay.gmail.com
verify return:1
---
Certificate chain
 0 s:CN = smtp-relay.gmail.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
 1 s:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1
 2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA

[cbellone]

update: I've been able to reproduce the issue with a gmail configuration, which uses TLSv1.3 It's probably due to a bug in the JDK 11.

The good news is that Alf.io M3 can run with Java 14, so here's what I did to solve the issue

• Download JDK14 from here: https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_linux_hotspot_14.0.2_12.tar.gz
• unzip and add to the path
• run alf.io using JDK14 instead of 11

let me know if this works for you

[mave-git]

Hi cllebone,

thank you very much! I'll give it a try. But: this must openjdk-14? My cloud server offers 13, 15, 16, 17. Because of this you sent a link to openjdk-14-jre?

[cbellone]

The problem has been solved in JDK12, so JDK13 should be also fine. If you want to use JDK15 you must install https://github.com/alfio-event/alf.io/releases/tag/2.0-M4.RC1 instead

[mave-git]

Ah! Should I start with a new database? I tried JDK 13 but on existing and new created events, event-urls are broken (error 404), Uuups ;-)

[cbellone]

no, using a different - compatible - JDK has no impact whatsoever on the application. I have done the same (installed with 11, restarted with 14) and I am able to access everything as before. The only difference is that the SMTP issue is now gone.

I would ask you to confirm that the email issue has been resolved, so that we can close this.

If you have further issues please double check your configuration and after that open another issue attaching the logs and trying to give as many details as possible about what's happening.

Thanks!

[mave-git]

would ask you to confirm that the email issue has been resolved, so that we can close this. Of course, but no check until existing events are not reachable (error 404) on my installation. Before, I've to see, why getting such a thing and can't booking tickets that forces outgoing mail messages. Thanks for all the help.

[mave-git]

... changing to JDK 13 brougt mismatch on created event-urls: M3 for example: https://alfio.mvtool.de/event/gfgr-stammtisch M4 => https://alfio.mvtool.de/alfio.mvtool.de/event/gfgr-stammtisch Trying M4 booking an event: no mails outgoing. I'll reset the vserver, starting with new installation to avoid configuration issues while testing. =>

Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version
        at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
        at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:312) ~[?:?]
        at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:?]
        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:185) ~[?:?]
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:171) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1483) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1389) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:441) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:412) ~[?:?]
        at com.sun.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:527) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.util.SocketFetcher.createSocket(SocketFetcher.java:332) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.util.SocketFetcher.getSocket(SocketFetcher.java:234) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.smtp.SMTPTransport.openServer(SMTPTransport.java:1927) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:654) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at javax.mail.Service.connect(Service.java:295) ~[mail-1.5.0-b01.jar!/:1.5.0-b01]
        at org.springframework.mail.javamail.JavaMailSenderImpl.connectTransport(JavaMailSenderImpl.java:518) ~[spring-context-support-5.3.6.jar!/:5.3.6]
        at org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:437) ~[spring-context-support-5.3.6.jar!/:5.3.6]
        ... 51 more
22:22:59.990 [scheduling-1] WARN  alfio.manager.NotificationManager - Message with id 80 will be discarded
22:22:59.992 [scheduling-1] WARN  alfio.manager.NotificationManager - Message with id 81 will be discarded
22:22:59.998 [scheduling-1] WARN  alfio.manager.NotificationManager - Message with id 83 will be discarded
22:23:00.002 [scheduling-1] WARN  alfio.manager.NotificationManager - Message with id 82 will be discarded
22:25:25.192 [qtp242408359-19] WARN  org.springframework.web.servlet.PageNotFound - No mapping for GET /alfio.mvtool.de/event/gfgr-stammtisch

[mave-git]

... took news vservers, switching JDK's, firewalls, protocols. No success... so stopped working on alf.io meanwhile. Maybe on final state of 2.0 trying again.

[icougil]

Hi! We are facing here the same issue with Java 17 trying to use gmail when sending emails. Do we need to include the extra SMTP config in the web/UI or not? mail.smtp.ssl.protocols=TLSv1.2 Best

[vb-03]

Facing this issue with Gmail and JDK 17 as well

[vb-03]

Got Gmail working with this config and an "App Password" for the password field (requires 2FA)

[icougil]

Got it working with your configuration as well. Thank you @vb-03 !

[tobsowo]

Thank you @vb-03 for helping to save time resolving this.

For anyone that might need to do this in future, here is the text version you can copy and paste:

mail.smtp.auth=true mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory mail.smtp.ssl.enable=true mail.smtp.starttls.enable=true mail.smtp.ssl.protocols=TLSv1.2 mail.smtp.starttls.required=true

[ChildApple]

Many Thanks @vb-03 your configuration worked on the latest production release of alfio on ubuntu 22.04 andusing a gmail account

[gverbist]

I cannot get this to work for the love of ...... using smtp2go.

In the logs I get :

[WARN ] 2024-07-24 12:09:55.112 [qtp2116511124-70] PageNotFound - No mapping for POST /session-expired [WARN ] 2024-07-24 12:10:16.063 [scheduling-1] NotificationManager - Message with id 2 will be discarded [WARN ] 2024-07-24 12:10:21.060 [scheduling-1] NotificationManager - Message with id 1 will be discarded