Why I always got "Verify certificate : False" ?

[jemm971]

Hello,
I configure my hmailserver (version 5.6.7-B2425) , and I can receive and send mails normally.
But in the log, with debug mode activated, I see that the certificate verification is always False.
And this seems strange because then then TLS/SSL handshake complete normally.

My configuration is :
Protocols/SMTP : "Use STARTTLS if available" is checked
Ports :
port 25 : SMTP STARTTLS (required)
port 587 : SMTP STARTTTLS (required)
port 993 : IMAP SSL/TLS
port 995 : POP3 SSL/TLS
My SSL certificate is indicated for all these protocols.

Here is the log :

Code: Select all

"DEBUG"	8672	"2020-10-07 16:19:28.041"	"Creating session 47511"
"TCPIP"	8672	"2020-10-07 16:19:28.041"	"TCP - 193.251.162.44 connected to 192.168.1.2:993."
"DEBUG"	8672	"2020-10-07 16:19:29.648"	"TCP connection started for session 47511"
"DEBUG"	8672	"2020-10-07 16:19:29.649"	"Performing SSL/TLS handshake for session 47511. Verify certificate: False"
"TCPIP"	6888	"2020-10-07 16:19:29.750"	"TCPConnection - TLS/SSL handshake completed. Session Id: 47511, Remote IP: 193.251.162.44, Version: TLSv1.2, Cipher: ECDHE-RSA-AES256-GCM-SHA384, Bits: 256"
"DEBUG"	6888	"2020-10-07 16:19:31.935"	"Ending session 47511"

I search on the forum, but I didn't find the reason of this "Verify certificate : False".
Any idea ? Thanks for the help.

[palinka]

Certificates are verified through certificate authorities. Many servers still use self signed certificates in order to establish a SSL connection. If you attempt verify a self signed certificate, it will fail and hmailserver will drop the connection.

There's no need to verify a sending server. All you care about is the secure connection, not the certificate. If you enable "verify certificates", sooner or later you're going to be dropping connections that are sending legit mail.

[mattg]

Not quite Palinka

hMailserver will ONLY attempt to verify certificates in specific cases.
That log line means that hmailserver did NOT attempt to verify the certificate

Many servers use self signed certificates, and these of course can't be verified
Many servers use a certificate that doesn't match the RDNS or even their local host name
Many antivirus clients deliberately make a man-in-the-middle attack to check SSL mail

In all of these case verification would fail (and there are other reasons too)


hMailserver does check, when the SSL/TLS setting to verify is set, and any of the following are happening
- POP3 External Download via StartTLS or via SSL
- SMTP Relayer using StartTLS or SSL
- SMTP Route (outgoing mail) using StartTLS or SSL

[mattg]

port 25 : SMTP STARTTLS (required)

This will limit your incoming mail.

There are many servers in the world that can't do StartTLS on port 25, and much is legitimate mail

[jemm971]

Thanks palinka and mattg for your explanations.

So if I correctly understand, you recommend to put :
in Settings/ Advanced/ SSL/TLS to unchecked the "Verify remote server SSL/TLS certificates"
in Settings/ Advanced/ TCP/IP ports , for SMTP on port 25 to set "connection security" to "STARTTLS (optional)" instead of "STARTTLS (required)"

Am I right ?

But is this new configuration more risky for spam or not ?

[mattg]

I leave 'verify remote server SSL/TLS certifciates' checked

If port 25 is 'StartTLS required' you will miss much GENUINE MAIL
You will still get SPAM.


Most of the spam that gets to my machine has valid DKIM, SPF, and comes via StartTLS