SMTP error: Connection error: Connection error: invalid peer certificate: Other(OtherError(UnsupportedCertVersion)) #6237
-
Prerequisites
Vaultwarden Support StringYour environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)Show Config & DetailsEnvironment settings which are overridden: ADMIN_TOKEN Config: {
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": false,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "****://**************************************",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_max_conns": 10,
"database_timeout": 30,
"database_url": "********://**************************************************************************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"domain": "****://***************************",
"domain_origin": "****://***************************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": "***************************",
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": true,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": true,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": "Login",
"smtp_debug": false,
"smtp_embed_images": false,
"smtp_explicit_tls": null,
"smtp_from": "***************************",
"smtp_from_name": "Vaultwarden",
"smtp_host": "**************************",
"smtp_password": "***",
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "***************************",
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}Vaultwarden Build Versionv1.34.3 Deployment methodOfficial Container Image Custom deployment methodI deployed Vaultwarden via TrueNAS Scale's application feature. More deployment details can be found in the screenshot below. Reverse Proxynginx proxy manager v2.12.6 Host/Server Operating SystemNAS/SAN Operating System VersionTrueNAS Scale 25.04.2.1 ClientsWeb Vault Client VersionNo response Steps To Reproduce
Expected ResultThe test email has been sent successfully. Actual ResultAn error pop-up appears with the following message: The test email was not sent. LogsScreenshots or Videos
Additional ContextThis issue has only emerged recently. Back in July of this year, Vaultwarden was able to send emails successfully under the same configuration. However, a few weeks ago (possibly after an update? I apologize for not being able to provide an exact timeline as I don’t use the email function daily), I stopped receiving password hint emails. I noticed this issue when checking the I’ve tried modifying various settings—such as toggling When configured to use other mail servers like Gmail or QQ Mail, Vaultwarden works perfectly and sends emails without issue. The problem seems isolated to its interaction with poste.io. That said, I don’t believe the issue lies with poste.io itself, as several my other services (such as Uptime Kuma, Firefly III, ssmtp, and Send-MailKit-Message) are using the exact same poste.io configuration to send emails without any problems. I haven’t yet tried deploying Vaultwarden via Docker, though I should note that six months ago, when I ran Vaultwarden in a Docker container, it worked flawlessly with the same poste.io settings. I migrated to TrueNAS Scale in May. If necessary, I can allocate time to test with a Docker deployment again. I’m uncertain whether this is a bug or if a recent update has invalidated certain configurations. I’ve searched online but haven’t found any reports of the same error message. If the issue is due to a misconfiguration on my end or if there are known solutions, please let me know. If it turns out the root cause isn’t related to Vaultwarden—for instance, if it’s an issue with poste.io or TrueNAS Scale—I will forward this issue (along with relevant details) to the appropriate developers. I believe I’ve exhausted all feasible troubleshooting steps, and this problem has been frustrating me for weeks. I’m happy to provide more detailed logs or information if needed. Please don’t hesitate to reach out. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 4 replies
-
|
This isn't an issue of Vaultwarden, but more of the server where you are connecting to, or something in between, like a mitmproxy/filtering-proxy or something like that. The certificate returned is just invalid. Either a missing chain cert, or an expired cert somewhere in the chain. openssl s_client -connect smtp.domain.tld:587 -starttls smtp -showcerts |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your reply. My mail server (poste.io) does not have a certificate configured. The situation is a bit complicated. To make a long story short, I've placed the server behind multiple layers of Cloudflare and a VPN for attack defense. This prevents the automatic renewal of Let's Encrypt certificates. I'm also quite lazy—manually renewing it every three months would be very difficult for me. So, I simply configured all services that require SMTP (and which have My understanding of cert is very limited, just enough to use it at a basic level. I thought that since I checked the Currently, the server and Vaultwarden are directly connected, only configured with DDNS. Nginx Proxy Manager only proxies the web interface of the mail server. Here is my openssl test result: The openssl result seems fine (based on my online research and consultations with AI). Shouldn’t checking the The current behavior makes it seem like the |
Beta Was this translation helpful? Give feedback.
-
|
I tested this just recently, and it works fine, at least with the tests i conducted, which included self-signed and invalid hostnames. That would make it more secure also. |
Beta Was this translation helpful? Give feedback.
-
|
I am having the same issue as the OP. openssl s_client -connect smtp.domain.tld:587 -starttls smtp -showcerts Connects without a problem or error. I found a possibly related issue in a different product when searching for a solution. My certs are V1. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry for the delay in following up. After some searching and testing, I can basically confirm the root cause: OpenSSL still accepts these older certificates, while My own situation made things more complicated: I had placed quite a few restrictions on my Strictly speaking, |
Beta Was this translation helpful? Give feedback.
I am having the same issue as the OP.
openssl s_client -connect smtp.domain.tld:587 -starttls smtp -showcerts
Connects without a problem or error.
I found a possibly related issue in a different product when searching for a solution. My certs are V1.
rustls/rustls#2364