Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #166605 > unrolled thread

exim4 - tls errors

Back to article view | Back to linux.debian.user

Contents

  exim4 - tls errors kjonca@poczta.onet.pl (Kamil Jońca) - 2016-04-11 07:10 +0200
    Re: exim4 - tls errors deloptes <deloptes@gmail.com> - 2016-04-11 08:40 +0200
      Re: exim4 - tls errors [partially solved] kjonca@poczta.onet.pl (Kamil Jońca) - 2016-04-12 04:00 +0200
        Re: exim4 - tls errors [partially solved] deloptes <deloptes@gmail.com> - 2016-04-12 21:40 +0200
    Re: exim4 - tls errors Elimar Riesebieter <riesebie@lxtec.de> - 2016-04-11 13:20 +0200
    Re: exim4 - tls errors Jörg-Volker Peetz <jvpeetz@web.de> - 2016-04-11 16:10 +0200
    Re: exim4 - tls errors [SOLVED] kjonca@poczta.onet.pl (Kamil Jońca) - 2016-04-22 08:30 +0200
      Re: exim4 - tls errors [SOLVED] deloptes <deloptes@gmail.com> - 2016-04-23 09:00 +0200
        Re: exim4 - tls errors [SOLVED] kjonca@poczta.onet.pl (Kamil Jońca) - 2016-04-24 17:20 +0200
          Re: exim4 - tls errors [SOLVED] deloptes <deloptes@gmail.com> - 2016-04-24 23:10 +0200

#166605 — exim4 - tls errors

I recently upgraded my box and now I got

--8<---------------cut here---------------start------------->8---
Warning: No server certificate defined; TLS connections will fail.
 Suggested action: either install a certificate or change tls_advertise_hosts option
--8<---------------cut here---------------end--------------->8---
with every mail I sent (but mails are delivered)
I tried to set

--8<---------------cut here---------------start------------->8---
tls_advertise_host = !* 
--8<---------------cut here---------------end--------------->8---
or remove it completely but with no success.
How can I get rid of this message? (Assuming I'm too lazy to create self
signed cert for this?)

KJ

-- 
http://stopstopnop.pl/stop_stopnop.pl_o_nas.html
Flame on!
		-- Johnny Storm

[toc] | [next] | [standalone]

#166607

Hi,

Kamil Jońca wrote:

> 
> I recently upgraded my box and now I got
> 
> --8<---------------cut here---------------start------------->8---
> Warning: No server certificate defined; TLS connections will fail.
>  Suggested action: either install a certificate or change
>  tls_advertise_hosts option
> --8<---------------cut here---------------end--------------->8---
> with every mail I sent (but mails are delivered)

Sure it's delivered because it's just a warning

> I tried to set
> 
> --8<---------------cut here---------------start------------->8---
> tls_advertise_host = !*
> --8<---------------cut here---------------end--------------->8---
> or remove it completely but with no success.
> How can I get rid of this message? (Assuming I'm too lazy to create self
> signed cert for this?)
> 
> KJ

Try to disable TLS

MAIN_TLS_ENABLE = false

in /etc/exim4/exim4.conf.template

regards

[toc] | [prev] | [next] | [standalone]

#166641 — Re: exim4 - tls errors [partially solved]

deloptes <deloptes@gmail.com> writes:

>
> Try to disable TLS
>
> MAIN_TLS_ENABLE = false
>
> in /etc/exim4/exim4.conf.template

Wrong. It was not defined, and this caused all tls_* options were unset
(tls_advertise_hosts in particular)

nevermind.
1. I used /usr/share/doc/exim4-base/examples/exim-gencert to generate
certs.
and set MAIN_TLS_ENABLE=true
and seems to work.

2. I tried also set
MAIN_TLS_ENABLE=true
and tls_advertise_hosts = !*
but still were warnings.
A I missing something?
KJ


-- 
http://wolnelektury.pl/wesprzyj/teraz/
When a fellow says, "It ain't the money but the principle of the thing,"
it's the money.
		-- Kim Hubbard

[toc] | [prev] | [next] | [standalone]

#166666 — Re: exim4 - tls errors [partially solved]

Kamil Jońca wrote:

> A I missing something?

its not clear if you tried to set to false, but I assume yes. I also assume
you restarted after setting the option to false/true

in main/03_exim4-config_tlsoptions you have this

# TLS/SSL configuration for exim as an SMTP server.
# See /usr/share/doc/exim4-base/README.Debian.gz for explanations.

.ifdef MAIN_TLS_ENABLE
# Defines what hosts to 'advertise' STARTTLS functionality to. The
# default, *, will advertise to all hosts that connect with EHLO.
.ifndef MAIN_TLS_ADVERTISE_HOSTS
MAIN_TLS_ADVERTISE_HOSTS = *
.endif
...
...
...

So either I have some older exim version or something is wrong there, but
unvisible because most of us use TLS.

Setting MAIN_TLS_ENABLE=false should skip the whole block of settings.

regards

[toc] | [prev] | [next] | [standalone]

#166614

* Kamil Jońca <kjonca@poczta.onet.pl> [2016-04-11 06:43 +0200]:

> tls_advertise_host = !*

I've tls_advertise_hosts = * and it works.

Elimar
-- 
  On the keyboard of life you have always
  to keep a finger at the escape key;-)

[toc] | [prev] | [next] | [standalone]

#166625

Hi KJ,

depending on which configuration scheme is used for exim4 (splitted config or
not) the file to be changed is different.
So either edit both locations (/etc/exim4/exim4.conf.template and a file in
/etc/exim4/conf.d) or make sure which scheme is used. To find out command

  grep -A2 'exim4/use_split_config' /var/cache/debconf/config.dat

and see what the line beginning with "Value:" says.

After configuration changes don't forget to execute "update-exim4.conf" as root.

The default configuration has
   tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS
and
   MAIN_TLS_ADVERTISE_HOSTS = *

See /etc/exim4/exim4.conf.template and
/etc/exim4/conf.d/main/03_exim4-config_tlsoptions.

Maybe there are local modifications in your configuration files. Then the update
should've stored new config files with ".dpkg-dist" or something added to their
normal names.

Regards,
jvp.

[toc] | [prev] | [next] | [standalone]

#166934 — Re: exim4 - tls errors [SOLVED]

kjonca@poczta.onet.pl (Kamil Jońca) writes:

some background 
1. with exim 4.87 tls_advertise_hosts defaults to *.
2. also MAIN_TLS_ADVERTISE_HOSTS (main/03_exim4-config_tlsoptions)
3. to get rid this message (excet to create certificate)
tls_advertise_hosts should be _empty_.

so set
--8<---------------cut here---------------start------------->8---
MAIN_TLS_ADVERTISE_HOSTS= ""
--8<---------------cut here---------------end--------------->8---
works.

Yes, I should read exim documentation earlier. :)

KJ

-- 
http://wolnelektury.pl/wesprzyj/teraz/
Answer a fool according to his folly, lest he be wise in his own conceit.
		-- Proverbs, 26:5

[toc] | [prev] | [next] | [standalone]

#167009 — Re: exim4 - tls errors [SOLVED]

Kamil Jońca wrote:

> kjonca@poczta.onet.pl (Kamil Jońca) writes:
> 
> some background
> 1. with exim 4.87 tls_advertise_hosts defaults to *.
> 2. also MAIN_TLS_ADVERTISE_HOSTS (main/03_exim4-config_tlsoptions)
> 3. to get rid this message (excet to create certificate)
> tls_advertise_hosts should be _empty_.
> 
> so set
> --8<---------------cut here---------------start------------->8---
> MAIN_TLS_ADVERTISE_HOSTS= ""
> --8<---------------cut here---------------end--------------->8---
> works.
> 
> Yes, I should read exim documentation earlier. :)
> 
> KJ
> 

This is not exactly correct. As statedbefore setting MAIN_TLS_ENABLE=false
should skip the whole block of settings related to SSL/TLS.
No idea why you should touch the supplementary config files.

regards

[toc] | [prev] | [next] | [standalone]

#167052 — Re: exim4 - tls errors [SOLVED]

deloptes <deloptes@gmail.com> writes:

> Kamil Jońca wrote:
>
>> kjonca@poczta.onet.pl (Kamil Jońca) writes:
>> 
>> some background
>> 1. with exim 4.87 tls_advertise_hosts defaults to *.
>> 2. also MAIN_TLS_ADVERTISE_HOSTS (main/03_exim4-config_tlsoptions)
>> 3. to get rid this message (excet to create certificate)
>> tls_advertise_hosts should be _empty_.
>> 
>> so set
>> --8<---------------cut here---------------start------------->8---
>> MAIN_TLS_ADVERTISE_HOSTS= ""
>> --8<---------------cut here---------------end--------------->8---
>> works.
>> 
>> Yes, I should read exim documentation earlier. :)
>> 
>> KJ
>> 
>
> This is not exactly correct. As statedbefore setting MAIN_TLS_ENABLE=false
> should skip the whole block of settings related to SSL/TLS.
> No idea why you should touch the supplementary config files.

Because I do not want to disable tls completly - I want to use tls whe
exim acts as client. But I do not want tls when my clients connect to
exim.(Its a home machine configured to use smarthosts)

KJ

-- 
http://stopstopnop.pl/stop_stopnop.pl_o_nas.html
We are so fond of each other because our ailments are the same.
		-- Jonathan Swift

[toc] | [prev] | [next] | [standalone]

#167058 — Re: exim4 - tls errors [SOLVED]

Kamil Jońca wrote:

> deloptes <deloptes@gmail.com> writes:
> 
>> Kamil Jońca wrote:
>>
>>> kjonca@poczta.onet.pl (Kamil Jońca) writes:
>>> 
>>> some background
>>> 1. with exim 4.87 tls_advertise_hosts defaults to *.
>>> 2. also MAIN_TLS_ADVERTISE_HOSTS (main/03_exim4-config_tlsoptions)
>>> 3. to get rid this message (excet to create certificate)
>>> tls_advertise_hosts should be _empty_.
>>> 
>>> so set
>>> --8<---------------cut here---------------start------------->8---
>>> MAIN_TLS_ADVERTISE_HOSTS= ""
>>> --8<---------------cut here---------------end--------------->8---
>>> works.
>>> 
>>> Yes, I should read exim documentation earlier. :)
>>> 
>>> KJ
>>> 
>>
>> This is not exactly correct. As statedbefore setting
>> MAIN_TLS_ENABLE=false should skip the whole block of settings related to
>> SSL/TLS. No idea why you should touch the supplementary config files.
> 
> Because I do not want to disable tls completly - I want to use tls whe
> exim acts as client. But I do not want tls when my clients connect to
> exim.(Its a home machine configured to use smarthosts)
> 
> KJ
> 

OK, but in this case you keep MAIN_TLS_ENABLE=true and look in that below
in /etc/exim4/exim4.conf.template

it means that if you add the variable MAIN_TLS_ADVERTISE_HOSTS in the
beginning of your conf.template with MAIN_TLS_ADVERTISE_HOSTS = "" it would
handle it as not set and set to *.

# Defines what hosts to 'advertise' STARTTLS functionality to. The
# default, *, will advertise to all hosts that connect with EHLO.
.ifndef MAIN_TLS_ADVERTISE_HOSTS
MAIN_TLS_ADVERTISE_HOSTS = *
.endif
tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS


if this is your case it might be worth talking to the exim4 folks and
perhaps raise a CR based on your case

regards

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web