http://coldfusion.com logo
Join Slack
Powered by
Good morning :slightly_smiling_face: I have some t...
# lucee
d
Good morning 🙂 I have some trouble with sending of mails. But I don't know if this issue is on my side or on the mail server. I got this error:
Copy code
[smtp server name] Could not connect to SMTP host: [smtp server name], port: 465
lucee.runtime.exp.NativeException: Could not connect to SMTP host: [smtp server name], port: 465
	at com.sun.mail.smtp.SMTPTransport.openServer(SMTPTransport.java:1961)
	at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:654)
	at javax.mail.Service.connect(Service.java:295)
	at lucee.runtime.net.smtp.SMTPSender.run(SMTPSender.java:59)
Caused by: javax.mail.MessagingException: Could not connect to SMTP host: [smtp server name], port: 465;
 nested exception is:
 	javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
	... 4 more
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
	at sun.security.ssl.HandshakeContext.(HandshakeContext.java:171)
	at sun.security.ssl.ClientHandshakeContext.(ClientHandshakeContext.java:103)
Lucee 5.3.6.61
z
time to upgrade, that version is very old and subject to a cve
i'm also guessing you're running a very old java version right?
d
1.8.0_382 (Red Hat, Inc.) 64bit
z
ok that's pretty recent
anyway, my advice is always, when you are running an old version of lucee, first check if the problem has already been fixed in the latest version
d
i cannot update lucce, it's a webhosting
@zackster I made some tests with commandbox. You are right. The reason is the old version. Everythings works with Lucee 5.4 and ACF2018
d
@Dirk This is TLS issue from the stack (
protocol is disabled or cipher suites are inappropriate
). I wonder if it's related to this: https://stackoverflow.com/a/67901142/16607349
d
Is it possible to update only the SSL component from Lucee?
How can I detect which protocols the mail server use and which are available into the lucee installation?
d
SSL is controlled by the JVM. Lucee's just using what's in the JVM. That post I gave you tells you how you can enable SSL trace debugging on the JVM (
<http://javax.net|javax.net>.debug=ssl:handshake
), which you can read more about here: https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ReadDebug.html That should give you insight on to exactly where things are failing. However, it would probably just be better to update Lucee to the latest version and make sure the JVM is updated. If possible, I'd move to at least Java 11.
f
According to your error message “`protocol is disabled or cipher suites are inappropriate`” so that basically means that the client (Lucee) and the Server cannot agree on what TLS protocol / cipher suites to use. If your JVM is up to date, then it could actually be that the server is wanting to use something less than TLS 1.2, which modern JVMs have disabled by default. If that is the case then you need the SMTP server updated to support TLS 1.2 or 1.3… there are ways to run checks to see what protocol the mail server wants to use, you can do it with openssl for example
d
nmap --script ssl-enum-ciphers -p 465 [smtp server name]
result:
Copy code
PORT    STATE SERVICE
465/tcp open  smtps
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (dh 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.1:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (dh 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (dh 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.3:
|     ciphers:
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: A
z
d
Problem solved: The Provider updated Lucee to 5.4.3.2
But still use Java 1.8.0_382
5 Views
Open in Slack
PreviousNext
Powered by