SMTP mail server issue with SSL

aaP_irbaaz2

When I am trying to connect 465 mail server from outside, I am getting this error in mail log
SSL_accept error from unknown
warning: TLS library problem: error:0A00010B:SSL routines::wrong version number:../ssl/record/ssl3_record.c:354:

Any idea how I can fix this ?

aaP_irbaaz2

issue I am seeing is when I am check certificate of mail server on third party website it is indicating it belongs to other sub domain name.
But When I check inside, certificate is same added under mail domain name.

aaP_demo1

aaP_irbaaz2
Yes, I have the same issues.

2025-04-27T17:30:10.084533+07:00 mail dovecot: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 1 secs): user=<>, rip=[CLIENT_IP], lip=[SERVER_IP], TLS handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42, session=<9vlLDcAzX/jcnul1>

I did enable pan-domain SSL on mail server, verify SSL Common Name matched with my hostname to the IMAP and SMTP. enable stored SSL directory to the smtpd_tls_chain_file correctly.

But Thunderbird App cannot match my email hostname to the correct SSL common name. It found my other SSL Common Name instead.

Do you have any other solution to fix this? I have updated the mail server to latest version now. but still not helped.

PS: I have enabled SMTP Relay on my mail server.
Edit: My SSL Certificate using Protocol : TLSv1.3 and Cipher : TLS_AES_256_GCM_SHA384

aaP_irbaaz2

I have sorted above issue by creating a website name with mail server hostname, generating ssl and installing same on both email server and website.

But Still I don't know how to configure SMTP as I am not able to connect to mail server from outside.

aaPanel_Kern

Hello,
You can refer to this tutorial:
https://www.aapanel.com/docs/Function/MailServer.html
https://www.aapanel.com/docs/Function/Tutorial/Mail_SMTP_configuration.html

aaP_irbaaz2

aaPanel_Kern
I have installed by trying specific mail server certificate as well Pan domain certificate but still under mail logs when trying to check SMTP with 465 port with third party services I can see SSL_Accept error.

aaP_demo1

aaP_demo1
Nevermind, I modify /etc/dovecot/conf.d/10-ssl.conf and restart dovecot service. I changed to outlook app and it is now working.

aaP_franks

aaP_demo1 what is exactly did you modify, i have the same issue

aaP_irbaaz2

This command give not output

openssl s_client -connect mail.mailname.me:465 -starttls smtp
Connecting to xxx.xxx.136.50
CONNECTED(00000005)

aaP_irbaaz2

in log I can see
SSL_accept error from unknown

aaPanel_Kern

At the same time, check the postfix configuration, which can be viewed in the server status
"mail.135mailtest.com" is replaced with your domain name
Put:
smtpd_tls_chain_files=/etc/ssl/private/ssl-cert-snakeoil.key,/etc/ssl/certs/ssl-cert-snakeoil.pem
Change to:
smtpd_tls_chain_files = /www/server/panel/plugin/mail_sys/cert/135mailtest.com/privkey.pem,/www/server/panel/plugin/mail_sys/cert/135mailtest.com/fullchain.pem
Note to replace 135mailtest.com with your domain name.
Also check /www/server/panel/plugin/mail_sys/cert/135mailtest.com/ for privkey.pem and fullchain.pem files

You can use this command to check whether the correct SSL is configured
openssl s_client -connect mail.135mailtest.com:587 -starttls smtp
or
openssl s_client -connect mail.135mailtest.com:465

If the display is not OK, try to save the SSL certificate again, or please re-apply for SSL

aaP_irbaaz2

aaPanel_Kern
Yes I have right SSL placed and running

openssl s_client -connect mail.135mailtest.com:465

Giving verify return code 0 ok

But on trying to connect from third party to port 465 giving timeout error

aaPanel_Kern

Hello,
Does the server provider's security group need to open the relevant ports?

aaP_irbaaz2

aaPanel_Kern
yes ports are opened, 465 is opened in appanel as well in modem

aaPanel_Kern

Hello,
Have you changed the domain name to your own?

aaP_irbaaz2

aaP_demo1

aaP_franks
For my case, In the /etc/dovecot/conf.d/10-ssl.conf file

I made some editing

# plain imap and pop3 are still allowed for local connections
ssl = required
ssl_min_protocol = TLSv1.2
ssl_prefer_server_ciphers = yes
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
ssl_cert = </www/server/panel/plugin/mail_sys/cert/[domain.tld]/fullchain.pem
ssl_key = </www/server/panel/plugin/mail_sys/cert/[domain.tld]/privkey.pem

#DOMAIN_SSL_BEGIN_[domain.tld]
local_name domain.tld {
    ssl_cert = < /www/server/panel/plugin/mail_sys/cert/[domain.tld]/fullchain.pem
    ssl_key = < /www/server/panel/plugin/mail_sys/cert/[domain.tld]/privkey.pem
}
#DOMAIN_SSL_END_[domain.tld]

Make sure:

• postfix myhostname is respectfully corrected as your server hostname while it was configured initially at the mail server settings.
• SSL Checking at 143 or 587 Service has a correct CN as your hostname

aaP_franks

aaPanel_Kern Hello
Have been following the trail because i also have same issue but after doing everything you stated and changing the domain still get the same error when trying to connect from outside

aaPanel_Kern

Check whether the port can communicate normally?

https://dnschecker.org/port-scanner.php

aaP_franks

aaP_irbaaz2

aaPanel_Kern
Yes it is showing port 465 opened

aaP_irbaaz2

in mail logs major I can see is
SSL_accept error
but I have verified multiple times SSL is looking fine to me.
I have tried with mail as well as PAN domain certificate but in all case I can see this error in mail logs

aaP_irbaaz2

On checking smtp from port 465 with Authentication and Secured connection checked from tool : https://www.smtper.net
getting this error in log.
earlier it use to work but not sure now why it don't