Error upgrading connection with STARTTLS: 502 5.5.1 Error: command not implemented

[smilebasti]

Hi, I got a new domain, added it to cloudron, set up my E-Mail but failed to set up my E-Mail-Relay.
I want to relay it to my Proxmox Mail Gateway like I do with my other, older and still functioning (Email-)Domains.

I set it to External SMTP server (No Authentication), enter the PMG host IP and the internal relaying port of PMG 26. I tested it with checked and not checked accept self signed certificates.
Then I get the error: Error upgrading connection with STARTTLS: 502 5.5.1 Error: command not implemented. That error I think comes from Proxmox.

Did in the last year something change in Cloudron that now forces the TLS while setup? Can i setup the connection manually to ignore TLS like the other domains do?

[girish]

@smilebasti in Cloudron 9, we decided to only accept STARTTLS servers which is the needed for some basic security . I guess for local intranet relays we can add an option to disable this.

In the meantime, you can edit /home/yellowtent/box/src/mail.js (depending on the version this can be mailserver.js or mailstatus.js). Look for requireTLS: true and just set this to false and systemctl restart box . That should let you add the relay. Haraka already support opportunistic STARTTLS .

[joseph]

The mail relay requires STARTTLS - https://docs.cloudron.io/email/#relay-outgoing-mails . Is that enabled in Proxmox?

[smilebasti]

@joseph
Hi, no and never was.
Ai gave me following command to test it:

openssl s_client -starttls smtp -connect 192.168.20.64:26 -crlf

CONNECTED(00000003)
Didn't find STARTTLS in server response, trying anyway...
40A70407AB700000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:354:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 239 bytes and written 326 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

Is there anything else I can provide?

My other 5 Domains that I have set up over a year ago are still working perfectly without any problem and never had. It just came up with the new domain I wanted to add.

So why do the old domains don't have that and how can I add the new one like the same as the old?
Is there a config file I can manually copy from the old domains and set it up manually to avoid the starttls check from the GUI?

[girish]

@smilebasti in Cloudron 9, we decided to only accept STARTTLS servers which is the needed for some basic security . I guess for local intranet relays we can add an option to disable this.

In the meantime, you can edit /home/yellowtent/box/src/mail.js (depending on the version this can be mailserver.js or mailstatus.js). Look for requireTLS: true and just set this to false and systemctl restart box . That should let you add the relay. Haraka already support opportunistic STARTTLS .

[smilebasti]

@girish Hi,

thank you. That worked perfectly.
Not sure how many people would need that function?