Ignore self signed SSL on SMTP relay server

[alvikashif]

I have setup a postal server 2.1.4 on Ubuntu 22.04.3 LTS as per the instructions in the documentation. I am using docker.

I want to relay emails from another SMTP server. While sending emails I am getting an error message, stating that the certificate verification failed as the smtp has a self-signed SSL.

SSL_connect returned=1 errno=0 peeraddr=192.168.xx.xx:25 state=error: certificate verify failed (self signed certificate)

Is there a way to allow postal server to trust this self-signed certificate?

Prior to this I was getting (EE certificate key too weak) error, which I solved by mounting the openssl.cnf file into the SMTP and worker containers and updating the CipherString = DEFAULT@SECLEVEL=1 in openssl.cnf file.

[Pacerino]

I'll guess you can mount the Root CA into the Container so the cert will be trusted. I couldn't find any "ignore self signed cert" option in postal.

[alvikashif]

Thank you @Pacerino for the answer. But I do not have access to the server's root CA.
The postal.yml in config folder has below configuration.

smtp_relays:
-
  hostname:  relay192.com
  port:  25
  ssl_mode:  None

I want the solution on postal server itself.
Any help would be really appreciated.

[Pacerino]

But that seems correct? For my understanding the server listed in this array will be used as relays. That seems like something you want.
@willpower232 Is my assumption correct?

Client -> Postal -> relay192.com
Is that your correct order?

[alvikashif]

The configuration for SMTP relay is correct. The postal server is also trying to connect to relay emails, but due to self-signed certificate on the SMTP server the verification fails. And the email status changes to "Soft Fail"

[Pacerino]

I've looked into the source code. Try to set the ssl_mode to Auto, the SMTP Client should start without verify_mode.

https://github.com/postalserver/postal/blob/main/lib/postal/smtp_sender.rb#L263
https://github.com/postalserver/postal/blob/main/lib/postal/smtp_sender.rb#L60

[alvikashif]

That worked
Thank you. @Pacerino

[hiddener]

Hi! I have the same error: certificate verify failed (self signed certificate). How should one set postal to trust/deliver to SMTP servers with self signed certificates? I mean without setting smtp_relays. Running 2.1.4. I'd appreciate any suggestion!

[Pacerino]

Update to the latest release. Postal now disables TLS and SSL verification by default.
https://github.com/postalserver/postal/blob/main/lib/postal/smtp_sender.rb#L69

[adamcooke]

Auto should still allow self signed certificates to work.