Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since I upgraded my PC from (k)ubuntu 12.04 to 12.10 I receive this error message when trying to send an email using sendemail.

Installing an older version of IO::Socket::SSL is not an option. I have the impression that all works as it should and the message is just a warning.

How can I get rid of this message?


SSL.pm

I think the below has to do with the problem (/usr/share/perl5/IO/Socket/SSL.pm).

34  use constant DEFAULT_VERSION     => 'SSLv23:!SSLv2';

...

251         my %default_args = (
252                 Proto => 'tcp',
253                 SSL_server => $is_server,
254                 SSL_use_cert => $is_server,
255                 SSL_check_crl => 0,
256                 SSL_version     => DEFAULT_VERSION,
257                 SSL_verify_mode => SSL_VERIFY_NONE,
258                 SSL_verify_callback => undef,
259                 SSL_verifycn_scheme => undef,  # don't verify cn
260                 SSL_verifycn_name => undef,    # use from PeerAddr/PeerHost
261                 SSL_npn_protocols => undef,    # meaning depends whether on server or client side
262                 SSL_honor_cipher_order => 0,   # client order gets preference
263         );

...

332         ${*$self}{'_SSL_ctx'} = IO::Socket::SSL::SSL_Context->new($arg_hash) || return;

sendemail

And at sendemail end I think it is about here in the code:

1903     ## Start TLS if possible
1904     if ($conf{'tls_server'} == 1 and $conf{'tls_client'} == 1 and $opt{'tls'} =~ /^(yes|auto)$/) {
1905         printmsg("DEBUG => Starting TLS", 2);
1906         if (SMTPchat('STARTTLS')) { quit($conf{'error'}, 1); }
1907         if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv3 TLSv1')) {
1908             quit("ERROR => TLS setup failed: " . IO::Socket::SSL::errstr(), 1);
1909         }
1910         printmsg("DEBUG => TLS: Using cipher: ". $SERVER->get_cipher(), 3);
1911         printmsg("DEBUG => TLS session initialized :)", 1);
1912 
1913         ## Restart our SMTP session
1914         if (SMTPchat('EHLO ' . $opt{'fqdn'})) { quit($conf{'error'}, 1); }
1915     }
1916     elsif ($opt{'tls'} eq 'yes' and $conf{'tls_server'} == 0) {
1917         quit("ERROR => TLS not possible! Remote SMTP server, $conf{'server'},  does not support it.", 1);
1918     }
share|improve this question
1  
Solved it for the time being by changing 'SSLv3 TLSv1'in sendemail line 1907 to 'SSLv3', but editing files installed from a package is bad. – jippie Oct 29 '12 at 19:43
up vote 6 down vote accepted

There is a bug report on Debian's bug tracker website: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=679911

It also states a workaround:

specify -o tls=no as an option on the command line.

Thanks @Manolo Díaz on debian.org.

share|improve this answer

Easier workaround is:

Replace:

m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))$}i

With:

m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))}i
share|improve this answer
    
Worked like a charm, thanks Nguli – NguliMkaree Dec 10 '13 at 9:16
    
My problem is that this fix breaks Net::Twitter – Dave Jacoby Nov 19 '14 at 16:40
    
1690 line /usr/share/perl5/IO/Socket/SSL.pm in Ubuntu 14.04 – Rahul Patil Jan 15 '15 at 7:08
    
Since some people still consider the workaround in this answer as the fix and complain about the bug in IO::Socket::SSL: The problem is not in IO::Socket::SSL but is a bug in sendEmail, which is unmaintained since 2009. In detail: the syntax for SSL_version is wrong and was not even valid at the time code was written, only IO::Socket::SSL did not complain then. The fix is just to remove the setting of SSL_version from sendemail. See also rt.cpan.org/Public/Bug/Display.html?id=77401. – Steffen Ullrich Sep 6 '15 at 6:23

Also a workaround, do this if it's required to send from smtp.gmail.com:

/usr/bin/sendemail on line 1907: 'SSLv3 TLSv1' => 'SSLv3' 

as temporary solution.

share|improve this answer

If you still get a certificate error after fixing the SSLversion as shown above, you need to disable certificate checking:

if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv23:!SSLv2', SSL_verify_mode => 0)) {
share|improve this answer
    
Haven't seen the issue myself for ages and the ubuntu package has been fixed in the mean while. First attempt into fixing this issue should be to patch the system / use most current versions of the software. The alternative solution is interesting from an other point of view though, thnx. – jippie Jan 15 at 19:12

Actually, just take the default (remove the second parameter). See https://metacpan.org/pod/IO::Socket::SSL (search for SSL_version). The default is SSLv23:!SSLv3:!SSLv2.

I modified line 1906 in v1.56 to read

#        if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv3 TLSv1')) {
    if (! IO::Socket::SSL->start_SSL($SERVER)) {

(just commenting out the original line)

share|improve this answer
if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv3')) {<br>

works on debian wheezy with sendEmail 1.56-2 and libio-socket-ssl-perl 1.76-2 and

if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv23:!SSLv2')) {<br>

works with …/IO/Socket/SSL.pm: 1.74 sendEmail: 1.56 in Ubuntu.

This has been a problem in ubuntu and debian repos for over a year.

share|improve this answer

To fix this, I edited sendEmail-v1.55 at line 1884 to change 'SSLv3 TLSv1' to 'SSLv3'.

OSX 10.10.1

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.