sslv3 alert handshake failure

[HLFH]

Hi, @aeris

Currently testing SMTP TLS encryption with Cryptcheck. https://cryptcheck.fr/smtp/dhautefeuille.eu

I am getting an error:

Erreur durant l’analyse : SSL_connect returned=1 errno=0 state=SSLv3 read server hello A: sslv3 alert handshake failure

Not sure why since everything seems correct.

Not sure if the time is correct on Cryptcheck service as well?

Any required logs or conf to submit (postfix, dovecot, openssl, ssldump...)?

➜ postconf mail_version
mail_version = 3.8.1
➜ dovecot --version
2.3.20 (80a5ac675d)
➜ openssl version
OpenSSL 3.1.1 30 May 2023 (Library: OpenSSL 3.1.1 30 May 2023)
➜ certbot --version
certbot 2.6.0

Using the latest versions available of these packages on Arch Linux.

Some of the postfix conf. I have:

# Smtp ( OUTGOING / Client )
smtp_tls_loglevel            = 2
smtp_tls_security_level      = may
smtp_tls_CApath              = /etc/ssl/certs
smtp_tls_CAfile              = /etc/ssl/certs/ca-certificates.crt
smtp_tls_protocols           = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_ciphers   = high
smtp_tls_exclude_ciphers     = aNULL, eNULL, EXPORT, DES, 3DES, RC2, RC4, MD5, PSK, SRP, DSS, AECDH, ADH
smtp_tls_note_starttls_offer = yes

# ---------------------------------------------------------------------------------------------------

# Smtpd ( INCOMING / Server )
smtpd_tls_loglevel            = 2
smtpd_tls_auth_only           = yes
smtpd_tls_security_level      = may
smtpd_tls_received_header     = yes
smtpd_tls_protocols           = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers   = high
smtpd_tls_eecdh_grade         = strong

smtpd_tls_exclude_ciphers = EXP, LOW, MEDIUM, aNULL, eNULL, SRP, PSK, kDH, DH, kRSA, DHE, DSS, RC4, DES, IDEA, SEED, ARIA, CAMELLIA, AESCCM8, 3DES, MD5, SHA

smtpd_tls_CApath              = /etc/ssl/certs
smtpd_tls_CAfile              = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_dh1024_param_file   = /etc/postfix/dhparams/4096/dh.pem
smtpd_tls_chain_files =
    /etc/letsencrypt/live/arch-server.dhautefeuille.eu/privkey.pem
    /etc/letsencrypt/live/arch-server.dhautefeuille.eu/fullchain.pem
tls_server_sni_maps = hash:/etc/postfix/sni.map
tls_preempt_cipherlist = yes
tls_random_source      = dev:/dev/urandom

smtp_tls_session_cache_database  = btree:${data_directory}/smtp_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
lmtp_tls_session_cache_database  = btree:${data_directory}/lmtp_scache

And for Dovecot:

ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
ssl_prefer_server_ciphers = yes
ssl_dh = </etc/dovecot/dhparams/4096/dh.pem

The whole Mail SNI is set up.

[HLFH]

@aeris It works with Hardenize but not with Cryptcheck. https://www.hardenize.com/report/dhautefeuille.eu/1688641166#email_tls

[aeris]

Hello,
I try to debug this issue but currently don't understand very well the root cause.
Seems analysis starts correctly, but at some point a handshake explode for no reason.

[aeris]

Analysis starts well, but then crash for no reason during curve checking… 🤔

[HLFH]

I probably get these errors:

juil. 07 13:04:00 arch-server postfix/smtpd[229081]: connect from unknown[...]
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: setting up TLS connection from unknown[...]
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: unknown[...]: TLS cipher list "aNULL:-aNULL:HIGH:MEDIUM:!SEED:!IDEA:!3DES:!RC2:!RC4:!RC5:!kDH:!kECDH:!aDSS:!MD5:+RC4:@S>
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept:before SSL initialization
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept:before SSL initialization
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL3 alert write:fatal:handshake failure
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept:error in error
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept error from unknown[...]: -1
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: warning: TLS library problem: error:0A0000C1:SSL routines::no shared cipher:ssl/statem/statem_srvr.c:2220:
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: lost connection after STARTTLS from unknown[...]
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: disconnect from unknown[...] ehlo=1 starttls=0/1 commands=1/2
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: connect from unknown[...]
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: setting up TLS connection from unknown[...]
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: unknown[...]: TLS cipher list "aNULL:-aNULL:HIGH:MEDIUM:!SEED:!IDEA:!3DES:!RC2:!RC4:!RC5:!kDH:!kECDH:!aDSS:!MD5:+RC4:@S>
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept:before SSL initialization
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept:before SSL initialization
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL3 alert write:fatal:handshake failure
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept:error in error
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: SSL_accept error from unknown[...]: -1
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: warning: TLS library problem: error:0A0000C1:SSL routines::no shared cipher:ssl/statem/statem_srvr.c:2220:
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: lost connection after STARTTLS from unknown[...]
juil. 07 13:04:00 arch-server postfix/smtpd[229081]: disconnect from unknown[...] ehlo=1 starttls=0/1 commands=1/2

[HLFH]

Might be related to an openssl bug: openssl/openssl#21346.
I may need to wait for openssl 3.2 release...