Insecure Mail Sending Warning

Insecure Mail Sending Warning

[Robert Thorpe]

When I send mail I get a warning about security.

> The TLS connection to <mailserver> is insecure for the following reason:
> 
> * TLS1.0 protocol is deprecated by standard bodies.

Where <mailserver> is the URL of my mailserver.

Can I fix this or is the problem on my mail provider's side?

I'm using port 587, which I thought was correct.

My init file doesn't have much in it for sending mail:

(setq send-mail-function 'smtpmail-send-it)
(setq smtpmail-smtp-server "<mailserver>")
(setq user-mail-address "rt@robertthorpeconsulting.com")
(setq smtpmail-smtp-service 587)

BR,
Robert Thorpe

Re: Insecure Mail Sending Warning

[Robert Pluim]

>>>>> On Fri, 23 Oct 2020 01:35:35 +0100, Robert Thorpe <rt@robertthorpeconsulting.com> said:

    Robert> When I send mail I get a warning about security.
    >> The TLS connection to <mailserver> is insecure for the following reason:
    >> 
    >> * TLS1.0 protocol is deprecated by standard bodies.

    Robert> Where <mailserver> is the URL of my mailserver.

    Robert> Can I fix this or is the problem on my mail provider's side?

The problem is on the mail provider's side, I think.

Iʼm kind of surprised that a real mail provider still enables
TLS1.0. You can test what it supports using

gnutls-cli -p 587 <mailserver>

    Robert> I'm using port 587, which I thought was correct.

587 is the mail submission port. It normally starts out in cleartext,
and is then upgraded to TLS with a STARTTLS command. Iʼd recommend
465, which is TLS-only (although you'd have to set
smtpmail-stream-type to 'tls)

You'd still get the warning, but at least the entire connection would
be encrypted (not that that means much when using TLS1.0)

Robert
-- 

Re: Insecure Mail Sending Warning

[Robert Thorpe]

>     Robert> Where <mailserver> is the URL of my mailserver.
>
>     Robert> Can I fix this or is the problem on my mail provider's side?
>
> The problem is on the mail provider's side, I think.

Thank you.  I'll contact my provider and ask them about it.

> Iʼm kind of surprised that a real mail provider still enables
> TLS1.0. You can test what it supports using
>
> gnutls-cli -p 587 <mailserver>

That command doesn't seem to give useful output.  It says:
> Processed 148 CA certificate(s).
> Resolving '<mailserver>:587'...
> Connecting to '81.17.254.9:587'...
> |<1>| Received record packet of unknown type 50
> *** Fatal error: An unexpected TLS packet was received.

Anyway, I'll talk to them about it.

>     Robert> I'm using port 587, which I thought was correct.
>
> 587 is the mail submission port. It normally starts out in cleartext,
> and is then upgraded to TLS with a STARTTLS command. Iʼd recommend
> 465, which is TLS-only (although you'd have to set
> smtpmail-stream-type to 'tls)
>
> You'd still get the warning, but at least the entire connection would
> be encrypted (not that that means much when using TLS1.0)

It seems that port 465 doesn't work.  The gnutls-cli command timed out
on it.

Thank you again,
Robert Thorpe

Re: Insecure Mail Sending Warning

[Robert Pluim]

>>>>> On Sat, 24 Oct 2020 02:48:09 +0100, Robert Thorpe <rt@robertthorpeconsulting.com> said:

    Robert> Where <mailserver> is the URL of my mailserver.
    >> 
    Robert> Can I fix this or is the problem on my mail provider's side?
    >> 
    >> The problem is on the mail provider's side, I think.

    Robert> Thank you.  I'll contact my provider and ask them about it.

    >> Iʼm kind of surprised that a real mail provider still enables
    >> TLS1.0. You can test what it supports using
    >> 
    >> gnutls-cli -p 587 <mailserver>

    Robert> That command doesn't seem to give useful output.  It says:
    >> Processed 148 CA certificate(s).
    >> Resolving '<mailserver>:587'...
    >> Connecting to '81.17.254.9:587'...
    >> |<1>| Received record packet of unknown type 50
    >> *** Fatal error: An unexpected TLS packet was received.

Sorry, thinko on my part. Try

gnutls-cli -starttls-proto=smtp -p 587 <mailserver>

This will connect using TCP and then try to upgrade to TLS with a
STARTTLS command.

I just tried it to your mailserver and it matches the warning from
Emacs:

- Status: The certificate is trusted.
- Description: (TLS1.0-X.509)-(RSA)-(AES-256-CBC)-(SHA1)

Robert
--