Documentation for TLS

[MikeParkin]

Hello,

Looking at the source it appears that you can run Mailhog with an SSL certificate.

Is this possible? If so, are there any docs to explain how to configure this?

Thanks
Mike

[ian-kent]

Hi @MikeParkin - it isn't currently, but it can be added 😄

[MikeParkin]

Hi @ian-kent,

I would happily update the documentation for this, if you could give some pointers as to how to configure TLS! I had a look at the source and tried googling for a solution - but nothing was obvious.

Mike

[ian-kent]

Thanks @MikeParkin

Sorry if my last message wasn't clear, TLS isn't currently supported in MailHog (or, I don't think it is, and I couldn't find anything in the code which suggested it was). Outbound SMTP will use TLS if the remote server supports it (i.e. by advertising STARTTLS), but that's it.

Adding TLS support for the UI, API and SMTP server should be relatively straightforward - I'll add it asap!

[MikeParkin]

Hi @ian-kent,

Ahh ok - I cannot remember why I thought MailHog supported HTTPS/TLS for the Web UI - I was sure I had read that somewhere. Having just been back through the documentation I cannot find any reference to it - maybe it was the STARTTLS on SMTP like you suggest!

That would be great, thank you!

Cheers
Mike

[immjohn]

Hello @ian-kent Pinging this topic as it has been a while and this would make it possible for me to use mailhog.

[MikeParkin]

Ping @ian-kent any update on this, with most of the web moving to TLS it would be great to get this included too. There is normally quite a bit of sensitive data kept within MailHog, so amazing to get it running under a secure protocol.

The UI is the main part we would like securing :-) If you require any help with this please point us in the right direction / give guidance about how you see this being implemented (it's about time I learnt some Go!)

[kafecho]

Hi all, do you know if MailHog supports START TLS for incoming connections?

[kajmagnus]

@MikeParkin

There is normally quite a bit of sensitive data kept within MailHog, so amazing to get it running under a secure protocol

Can I ask how do you use MailHog? I thought it was for testing & development only, not production?

Anyway TLS and STARTTLS support for incoming email would be great :- )
The only thing I want to do, is to test sending emails via TLS from my app server and I haven't found any "dummy " smtp server that supports this (except for https://github.com/mailslurper/mailslurper but its Docker image won't build *[Edit, next day] Now the image builds and it supports TLS, but not STARTTLS (as far as I've seen) *[/Edit]).

[adkron]

I would love to have this too. I'm working on a system that has to be able to be configured for secure email and it would be great to have mailhog for testing that.

[MikeParkin]

@kajmagnus we use it on staging/development servers, but often those have copies of sensitive customer information, for example email order confirmations of a customers address.

We only run HTTPS for our websites, so having to read the email via http://$DOMAIN:PORT is frustrating. (Mainly because I always forget to remove the 's' when i've triggered the email on https://$DOMAIN!) but also obviously for better security :)

[kajmagnus]

@MikeParkin Ok :- ) Thanks for explaining.

[Nklya]

@MikeParkin You can setup nginx with https and set upstream to MailHog.

The bigger problem is that MailHog doesn't support STARTTLS for smtp.

[ameliabradley]

It's worth noting that Go's own net/smtp disallows sending emails unless TLS is enabled or the recipient is localhost:

Snippet from src/net/smtp/auth.go

func (a *plainAuth) Start(server *ServerInfo) (string, []byte, error) {
	// Must have TLS, or else localhost server.
	// Note: If TLS is not true, then we can't trust ANYTHING in ServerInfo.
	// In particular, it doesn't matter if the server advertises PLAIN auth.
	// That might just be the attacker saying
	// "it's ok, you can trust me with your password."
	if !server.TLS && !isLocalhost(server.Name) {
		return "", nil, errors.New("unencrypted connection")
	}
	if server.Name != a.host {
		return "", nil, errors.New("wrong host name")
	}
	resp := []byte(a.identity + "\x00" + a.username + "\x00" + a.password)
	return "PLAIN", resp, nil
}

Despite the fact that MailHog is written in Go, it cannot generally receive messages from Go 🙃

[fstaudt]

To improve the quality of my tests, I would also appreciate to have TLS support for SMTP in mailhog.
Our SMTP client has TLS configuration that can't currently be tested with Mailhog.

It would be great to have this optional by configuration.

[vanDonselaar]

As a workaround you could use Stunnel as a reverse STARTTLS proxy in front of MailHog.

[kernle32dll]

I thought I might chime in on this, after hitting the same road block (see go remark above on non localhost connections). The things I was able to figure out so far:

The mailhog/smtp repo looks like it already got basic support for TLS. At least, state machine wise.

However, as the code of mailhog overall stands right now, that TLS logic is not triggered, since the appropriate handler is not set. So, that would needs to be done in mailhog/MailHog-Server.

So, that would take care of protocol stuff. Now, the tricky part then would be to deliver actually TLS encrypted output back to the caller. This is where I got stuck. My best guess would be to upgrade the connection, but at the appropriate code part in mailhog/MailHog-Server, we don't have any tcp connection, but a bare io.ReadWriteCloser.

Taking some inspiration from this repo, it seems we would need to "replace" the connection, with a new TLS wrapped one (or to be more precise, the io.ReadWriteCloser in this case here) Maybe it would be fair to pass in a "upgrade" function into mailhog/MailHog-Server, which would be transparently passed down to the smtp state machine. The caller of Accept would then need to handle the aforementioned connection wrapping and (preferable by pointer magic) reader replacement.

The rest would then be simple config extension of mailhog/MailHog-Server/config, to parse and store certificates. Well maybe throw in some automatic certificate generation for good measure ;-)

So, anyone up to the task? :D

[kernle32dll]

Actually, I POC'd the necessary changes myself, and got a kinda working TLS implementation (well, good enough for testing purposes, in the spirit of this project).

It basically boils down to this commit.

I needed to fix up quite a bit of other stuff - the repos are IMO not in a very good shape.

If you want to check out my work, clone my forked repo, get yourself a self-signed server cert and key, and start via go run main.go -certs-paths ./server.crt,./server.key.

I will test this a bit, and decide where to go from here. Either trying to get this in this repo, or maintain my own fork.

NOTE: As the certificate is self-signed, ensure that you either disable host verification in your client, or tell it to trust the server certificate otherwise.

EDIT: Now Docker flavored: https://hub.docker.com/r/kernle32dll/mailhog

[wilmardo]

@kernle32dll Awesome work, will you try to get it merged upstream?

[kernle32dll]

@wilmardo I dunno. I would be all for getting it upstreamed. On the other hand, there seems to be no recent movement in this repo. So, even if I would create some PRs, I don't see them getting merged anytime soon.

I would love to maintain a fork, but looking at the sheer number of open issues, I don't think I can handle this anytime soon either.

[xoroz]

Hello everyone, I have the same issue our SMTP server authenticate using TLS/STARTLS and mailhog does not support it.
I found a very nice project writtin in perl that supports it all http://www.jetmore.org/john/code/swaks/
I am mainly using it to send thru mail-hog, but the outbound to SMTP TLS still a problem...

[mpking828]

Actually, I POC'd the necessary changes myself, and got a kinda working TLS implementation
@kernle32dll
Just throwing this at you, since I don't have enough talent to do it myself.
https://tools.ietf.org/html/rfc8314

Does your implementation support both Implicit TLS, and STARTTLS?

[levshvarts]

@wilmardo I dunno. I would be all for getting it upstreamed. On the other hand, there seems to be no recent movement in this repo. So, even if I would create some PRs, I don't see them getting merged anytime soon.

I would love to maintain a fork, but looking at the sheer number of open issues, I don't think I can handle this anytime soon either.

@kernle32dll Looks like this repo is active again, with #296 Created to track the progress of this issue. You can probably submit you pull request against that one.

[flexguse]

@kernle32dll Thanks for your work! I used your Docker Image and SwithMail is able to send Mails to MailHog when the Checkbox "TLS / SSL" is checked.
Unfortunately in the mailheader there is no hint that TLS was used. Is this the normal behavior?

In general it is a pity Mailhog does not support incoming SMTP traffic with TLS by default. How can we test our mail implementations when the requirement is to have a secure hint in the users mailclient?

[teunis90]

@vanDonselaar thanks for your tip, I got it working.

To save the rest some time, with this docker-compose example you'll have STARTTLS out of the box ;)

---
version: '2.2'
services:
  mailhog:
    image: mailhog/mailhog
    restart: always
    ports:
      - 1025:1025 # smtp server
      - 8025:8025 # web ui
  stunnel:
    image: dweomer/stunnel
    restart: always
    environment:
      - STUNNEL_SERVICE=smtps
      - STUNNEL_ACCEPT=465
      - STUNNEL_CONNECT=mailhog:1025
    volumes:
      - ./ssl/your.domain.tld-chained.cer:/etc/stunnel/stunnel.pem:ro
      - ./ssl/your.domain.tld.key:/etc/stunnel/stunnel.key:ro
    ports:
      - 465:465 # smtp tls

[Tonyette]

Hello everyone, I have a quick question please and I have read through all the issues but I couldn't find the best answer for what I want so we run Mailhog presently on our test env with Kubernetes and an NGINX ingress, I am able to see the UI but the smtp server is not reachable. I have tried configuring the ingress controller to allow TCP connections but it still does not solve my problem. Does anyone also run it securely on K8s, what methods did you use?