When I am trying to connect 465 mail server from outside, I am getting this error in mail log SSL_accept error from unknown warning: TLS library problem: error:0A00010B:SSL routines::wrong version number:../ssl/record/ssl3_record.c:354: Any idea how I can fix this ?

issue I am seeing is when I am check certificate of mail server on third party website it is indicating it belongs to other sub domain name. But When I check inside, certificate is same added under mail domain name.

I have sorted above issue by creating a website name with mail server hostname, generating ssl and installing same on both email server and website. But Still I don't know how to configure SMTP as I am not able to connect to mail server from outside.

Hello, You can refer to this tutorial: https://www.aapanel.com/docs/Function/MailServer.html https://www.aapanel.com/docs/Function/Tutorial/Mail_SMTP_configuration.html aaP_irbaaz2

aaP_irbaaz2 Yes, I have the same issues. 2025-04-27T17:30:10.084533+07:00 mail dovecot: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 1 secs): user=<>, rip=[CLIENT_IP], lip=[SERVER_IP], TLS handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42, session=<9vlLDcAzX/jcnul1> I did enable pan-domain SSL on mail server, verify SSL Common Name matched with my hostname to the IMAP and SMTP. enable stored SSL directory to the smtpd_tls_chain_file correctly. But Thunderbird App cannot match my email hostname to the correct SSL common name. It found my other SSL Common Name instead. Do you have any other solution to fix this? I have updated the mail server to latest version now. but still not helped. PS: I have enabled SMTP Relay on my mail server. Edit: My SSL Certificate using Protocol : TLSv1.3 and Cipher : TLS_AES_256_GCM_SHA384

aaP_demo1 Nevermind, I modify /etc/dovecot/conf.d/10-ssl.conf and restart dovecot service. I changed to outlook app and it is now working.

aaPanel_Kern I have installed by trying specific mail server certificate as well Pan domain certificate but still under mail logs when trying to check SMTP with 465 port with third party services I can see SSL_Accept error.

This command give not output openssl s_client -connect mail.mailname.me:465 -starttls smtp Connecting to xxx.xxx.136.50 CONNECTED(00000005)

in log I can see SSL_accept error from unknown

At the same time, check the postfix configuration, which can be viewed in the server status "mail.135mailtest.com" is replaced with your domain name Put: smtpd_tls_chain_files=/etc/ssl/private/ssl-cert-snakeoil.key,/etc/ssl/certs/ssl-cert-snakeoil.pem Change to: smtpd_tls_chain_files = /www/server/panel/plugin/mail_sys/cert/135mailtest.com/privkey.pem,/www/server/panel/plugin/mail_sys/cert/135mailtest.com/fullchain.pem Note to replace 135mailtest.com with your domain name. Also check /www/server/panel/plugin/mail_sys/cert/135mailtest.com/ for privkey.pem and fullchain.pem files You can use this command to check whether the correct SSL is configured openssl s_client -connect mail.135mailtest.com:587 -starttls smtp or openssl s_client -connect mail.135mailtest.com:465 If the display is not OK, try to save the SSL certificate again, or please re-apply for SSL aaP_irbaaz2

aaPanel_Kern Yes I have right SSL placed and running openssl s_client -connect mail.135mailtest.com:465 Giving verify return code 0 ok But on trying to connect from third party to port 465 giving timeout error

SMTP mail server issue with SSL

aaPanel_Kern

Hello,
Does the server provider's security group need to open the relevant ports?

aaP_irbaaz2

aaPanel_Kern
yes ports are opened, 465 is opened in appanel as well in modem

aaPanel_Kern

Hello,
Have you changed the domain name to your own?

aaP_irbaaz2

aaP_franks

aaP_demo1 what is exactly did you modify, i have the same issue

aaP_demo1

aaP_franks
For my case, In the /etc/dovecot/conf.d/10-ssl.conf file

I made some editing

# plain imap and pop3 are still allowed for local connections
ssl = required
ssl_min_protocol = TLSv1.2
ssl_prefer_server_ciphers = yes
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
ssl_cert = </www/server/panel/plugin/mail_sys/cert/[domain.tld]/fullchain.pem
ssl_key = </www/server/panel/plugin/mail_sys/cert/[domain.tld]/privkey.pem

#DOMAIN_SSL_BEGIN_[domain.tld]
local_name domain.tld {
    ssl_cert = < /www/server/panel/plugin/mail_sys/cert/[domain.tld]/fullchain.pem
    ssl_key = < /www/server/panel/plugin/mail_sys/cert/[domain.tld]/privkey.pem
}
#DOMAIN_SSL_END_[domain.tld]

Make sure:

• postfix myhostname is respectfully corrected as your server hostname while it was configured initially at the mail server settings.
• SSL Checking at 143 or 587 Service has a correct CN as your hostname

aaP_franks

aaPanel_Kern Hello
Have been following the trail because i also have same issue but after doing everything you stated and changing the domain still get the same error when trying to connect from outside

aaPanel_Kern

Check whether the port can communicate normally?

https://dnschecker.org/port-scanner.php

aaP_franks

aaP_irbaaz2

aaPanel_Kern
Yes it is showing port 465 opened

aaP_irbaaz2

in mail logs major I can see is
SSL_accept error
but I have verified multiple times SSL is looking fine to me.
I have tried with mail as well as PAN domain certificate but in all case I can see this error in mail logs

aaP_irbaaz2

On checking smtp from port 465 with Authentication and Secured connection checked from tool : https://www.smtper.net
getting this error in log.
earlier it use to work but not sure now why it don't

aaP_irbaaz2

is there any wrong in this configuration file

See /usr/share/postfix/main.cf.dist for a commented, more complete version

Debian specific: Specifying a file name will cause the first

line of that file to be used as the name. The Debian default

is /etc/mailname.

#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

appending .domain is the MUA's job.

append_dot_mydomain = no

Uncomment the next line to generate "delayed mail" warnings

#delay_warning_time = 4h

readme_directory = no

See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on

fresh installs.

compatibility_level = 3.6

TLS parameters

#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level = may

smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.domain.me
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydomain = domain.me
myorigin = mail.domain.me
mydestination = mail.domain.me
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_mailbox_domains = sqlite:/etc/postfix/sqlite_virtual_domains_maps.cf
virtual_alias_maps = sqlite:/etc/postfix/sqlite_virtual_alias_maps.cf, sqlite:/etc/postfix/sqlite_virtual_alias_domain_maps.cf, sqlite:/etc/postfix/sqlite_virtual_alias_domain_catchall_maps.cf
virtual_mailbox_maps = sqlite:/etc/postfix/sqlite_virtual_mailbox_maps.cf, sqlite:/etc/postfix/sqlite_virtual_alias_domain_mailbox_maps.cf
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_use_tls = yes
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_alias_domains = localhost, localhost.domain.me
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_protocol = 6
milter_default_action = accept
message_size_limit = 102400000
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access
smtpd_tls_chain_files = /www/server/panel/plugin/mail_sys/cert/domain.me/privkey.pem,/www/server/panel/plugin/mail_sys/cert/domain.me/fullchain.pem
tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map
lmtp_host_lookup = native
smtp_host_lookup = native
bounce_queue_lifetime = 1h
maximal_queue_lifetime = 1h

aaPanel_Kern

Add # comments on these configurations

smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access

lmtp_host_lookup = native
smtp_host_lookup = native
bounce_queue_lifetime = 1h
maximum_queue_lifetime = 1h

Will
smtpd_tls_chain_files = /www/server/panel/plugin/mail_sys/cert/domain.me/privkey.pem,/www/server/panel/plugin/mail_sys/cert/domain.me/fullchain.pem
Modified to:

smtpd_tls_cert_file = /www/server/panel/plugin/mail_sys/cert/domain.me/fullchain.pem
smtpd_tls_key_file = /www/server/panel/plugin/mail_sys/cert/domain.me/privkey.pem

Is it normal to restart postfix in the end

aaP_irbaaz2

« Previous Page