[SOLVED] warning: TLS library problem: tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c

[kez]

Hi Guys,

Had to replace node4 in the cluster with a new VPS.

I am now seeing this in the node4 /var/log/mail.log

Apr 24 15:59:28 node4 postfix/smtpd[6480]: connect from some.mail.server[1.2.3.4]
Apr 24 15:59:28 node4 postfix/smtpd[6480]: warning: TLS library problem: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c:1562:SSL alert number 48:
Apr 24 15:59:28 node4 postfix/smtpd[6480]: lost connection after STARTTLS from some.mail.server[1.2.3.4]
Apr 24 15:59:28 node4 postfix/smtpd[6480]: disconnect from some.mail.server[1.2.3.4] ehlo=1 starttls=1 commands=2

Any ideas?

Thans,
C

 

[Stoiko Ivanov]

any adaptations to the postfix config?
any TLS policies configured?

does the remote server 1.2.3.4 maybe require a particular TLS certificate from the old machine?!

 

[kez]

Hi Stoiko,

Hope you're keeping well.

So this node4 is a fresh install to replace a failed server. Nothing has been changed and it was installed via your ISO and then added to our cluster with the same name etc. as the failed one i.e node4.

The mail server - some.mail.server[1.2.3.4] - one of our SmarterMail servers that uses this cluster as a smarthost/gateway.

Its working fine now and has been for a long time on this cluster. Its only this new node that has the issue.

Thanks,
C

 

[Stoiko Ivanov]

I've seen this error message - and it was always related to something not working with the certificates.
(sometimes clients expect a trusted certificate, sometimes a specific one) - I'd suggest to compare the smtp certificate of the new node to the ones from the working ones....

 

[kez]

I've seen this error message - and it was always related to something not working with the certificates.
(sometimes clients expect a trusted certificate, sometimes a specific one) - I'd suggest to compare the smtp certificate of the new node to the ones from the working ones....

BINGO! I had forgotten to set/install the SSL in Configuration > Certificates