PHPMailer enforce TLS1.2
Nieuwe security standards forceren TLS1.2 op de smtp server.
Ik maak gebruik van PHPMailer, maar ik raak maar niet verbonden.
De server ondersteund geen STARTTLS, alleen puur TLS1.2
Via een shell sessie krijg ik het alleen voor elkaar om te verbinden met netcat:
ncat --tls smtp.mycompany.com 25
Vervolgens kan ik simpelweg EHLO, AUTH LOGIN etc etc doen
Als ik handmatig in de de stream_context_create options toevoeg, raak ik wel verbonden maar ik krijg geen reacties.
Code (php)
1
2
3
4
5
6
2
3
4
5
6
$mail->SMTPOptions = array(
'ssl' => array(
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'ciphers' => 'SHA256'
)
);
'ssl' => array(
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'ciphers' => 'SHA256'
)
);
Result:
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
2020-04-22 11:56:28 Connection: opening to smtp.mycompany.com:25, timeout=300, options=array (
'ssl' =>
array (
'crypto_method' => 33,
),
)
2020-04-22 11:56:28 Connection: opened
2020-04-22 12:01:28 SMTP -> get_lines(): select timed-out in (300 sec)
2020-04-22 12:01:28 SERVER -> CLIENT:
2020-04-22 12:01:28 CLIENT -> SERVER: EHLO mycompany.com
2020-04-22 12:01:28 SMTP INBOUND: ""
2020-04-22 12:01:28 SERVER -> CLIENT:
2020-04-22 12:01:28 SMTP ERROR: EHLO command failed:
2020-04-22 12:01:28 SMTP NOTICE: EOF caught while checking if connected
2020-04-22 12:01:28 Connection: closed
2020-04-22 12:01:28 SMTP Error: Could not connect to SMTP host.
2020-04-22 12:01:28 SMTP Error: Could not connect to SMTP host.
'ssl' =>
array (
'crypto_method' => 33,
),
)
2020-04-22 11:56:28 Connection: opened
2020-04-22 12:01:28 SMTP -> get_lines(): select timed-out in (300 sec)
2020-04-22 12:01:28 SERVER -> CLIENT:
2020-04-22 12:01:28 CLIENT -> SERVER: EHLO mycompany.com
2020-04-22 12:01:28 SMTP INBOUND: ""
2020-04-22 12:01:28 SERVER -> CLIENT:
2020-04-22 12:01:28 SMTP ERROR: EHLO command failed:
2020-04-22 12:01:28 SMTP NOTICE: EOF caught while checking if connected
2020-04-22 12:01:28 Connection: closed
2020-04-22 12:01:28 SMTP Error: Could not connect to SMTP host.
2020-04-22 12:01:28 SMTP Error: Could not connect to SMTP host.
Is er iemand die meer kennis heeft van PHPMailer die mij hier mee kan helpen?
Gewijzigd op 22/04/2020 14:30:45 door Dennis WhoCares
Is OpenSSL geinstalleerd?
Wat zeggen phpinfo() en openssl_get_cipher_methods() over de aanwezige/ondersteunde ciphers?
Welke versie van PHPMailer gebruik je?
Hoe luidt de configuratie van gebruik van PHPMailer? Geef je bijvoorbeeld het protocol (ssl://) aan in de Host? Dit overschrijft mogelijk andere configuratie zoals SMTPSecure, dus hoe je de configuratie opstelt komt blijkbaar nogal nauw.
Communiceer je via de juiste poort? Poort 25 is dan standaard voor SMTP, maar andere poorten (denk aan 465 en 587) worden default voor SSL/TLS gebruikt als ik de WIKI mag geloven.
Gewijzigd op 22/04/2020 23:27:00 door Thomas van den Heuvel
Goede vragen! Ik dacht misschien is het iets standaards..
PHP Version (phpinfo)
Code (php)
1
2
3
2
3
Core
PHP Version => 7.2.24-0ubuntu0.18.04.4
PHP Version => 7.2.24-0ubuntu0.18.04.4
OpenSSL (phpinfo)
Code (php)
1
2
3
4
5
6
2
3
4
5
6
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.1.1d 10 Sep 2019
OpenSSL Header Version => OpenSSL 1.1.1 11 Sep 2018
Openssl default config => /usr/lib/ssl/openssl.cnf
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.1.1d 10 Sep 2019
OpenSSL Header Version => OpenSSL 1.1.1 11 Sep 2018
Openssl default config => /usr/lib/ssl/openssl.cnf
PHPMailer: Master Branch: https://github.com/PHPMailer/PHPMailer/tree/master/src
Ik verneem dat dit versie 6.1.5 is vanuit de Readme
test.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
error_reporting(E_ALL);
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;
require __dir__ . '/phpmailer/Exception.php';
require __dir__ . '/phpmailer/PHPMailer.php';
require __dir__ . '/phpmailer/SMTP.php';
$mail = new PHPMailer(true);
try {
$mail->SMTPDebug = SMTP::DEBUG_LOWLEVEL;
$mail->isSMTP();
$mail->Host = 'smtp.mycompany.com';
$mail->SMTPAuth = TRUE;
$mail->SMTPSecure = 'tls';
$mail->Username = 'username';
$mail->Password = 'pass';
$mail->Port = 25;
$mail->SMTPOptions = array(
'ssl' => array(
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'ciphers' => 'SHA256' // (met of zonder cipher keuze maakt niet uit) Results blijft hetzelfde
)
);
$mail->setFrom('[email protected]','NoReply');
$mail->addAddress('[email protected]','Dennis');
$mail->Subject = 'New SMTP Server';
$mail->Body = 'Hello Dennis, new SMTP server here';
$mail->send();
echo 'Message has been sent';
} catch (Exception $e) {
echo "Message could not be sent. Mailer Error: {$mail->ErrorInfo}";
}
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;
require __dir__ . '/phpmailer/Exception.php';
require __dir__ . '/phpmailer/PHPMailer.php';
require __dir__ . '/phpmailer/SMTP.php';
$mail = new PHPMailer(true);
try {
$mail->SMTPDebug = SMTP::DEBUG_LOWLEVEL;
$mail->isSMTP();
$mail->Host = 'smtp.mycompany.com';
$mail->SMTPAuth = TRUE;
$mail->SMTPSecure = 'tls';
$mail->Username = 'username';
$mail->Password = 'pass';
$mail->Port = 25;
$mail->SMTPOptions = array(
'ssl' => array(
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'ciphers' => 'SHA256' // (met of zonder cipher keuze maakt niet uit) Results blijft hetzelfde
)
);
$mail->setFrom('[email protected]','NoReply');
$mail->addAddress('[email protected]','Dennis');
$mail->Subject = 'New SMTP Server';
$mail->Body = 'Hello Dennis, new SMTP server here';
$mail->send();
echo 'Message has been sent';
} catch (Exception $e) {
echo "Message could not be sent. Mailer Error: {$mail->ErrorInfo}";
}
mbt de server, is inderdaad port 25 gebruikt hoewel default bij smtps enz. andere poorten zijn maar dit is aangegeven door de beheerder in US, de andere porten accepteren geen verbindingen.
STARTTLS wordt geweigerd, ik moet echt met TLSv1.2 verbinding maken wil de server uberhaubt reageren.
Via terminal, over telnet of openssl_connect krijg ik ook geen verbinding voor elkaar (wellicht lack aan kennis ook), maar over netcat lukt het wel: ncat --tls smtp.mycompany.com 25
openssl_get_cipher_methods()
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
Array
(
[0] => aes-128-cbc
[1] => aes-128-cbc-hmac-sha1
[2] => aes-128-cbc-hmac-sha256
[3] => aes-128-ccm
[4] => aes-128-cfb
[5] => aes-128-cfb1
[6] => aes-128-cfb8
[7] => aes-128-ctr
[8] => aes-128-ecb
[9] => aes-128-gcm
[10] => aes-128-ocb
[11] => aes-128-ofb
[12] => aes-128-xts
[13] => aes-192-cbc
[14] => aes-192-ccm
[15] => aes-192-cfb
[16] => aes-192-cfb1
[17] => aes-192-cfb8
[18] => aes-192-ctr
[19] => aes-192-ecb
[20] => aes-192-gcm
[21] => aes-192-ocb
[22] => aes-192-ofb
[23] => aes-256-cbc
[24] => aes-256-cbc-hmac-sha1
[25] => aes-256-cbc-hmac-sha256
[26] => aes-256-ccm
[27] => aes-256-cfb
[28] => aes-256-cfb1
[29] => aes-256-cfb8
[30] => aes-256-ctr
[31] => aes-256-ecb
[32] => aes-256-gcm
[33] => aes-256-ocb
[34] => aes-256-ofb
[35] => aes-256-xts
[36] => aria-128-cbc
[37] => aria-128-ccm
[38] => aria-128-cfb
[39] => aria-128-cfb1
[40] => aria-128-cfb8
[41] => aria-128-ctr
[42] => aria-128-ecb
[43] => aria-128-gcm
[44] => aria-128-ofb
[45] => aria-192-cbc
[46] => aria-192-ccm
[47] => aria-192-cfb
[48] => aria-192-cfb1
[49] => aria-192-cfb8
[50] => aria-192-ctr
[51] => aria-192-ecb
[52] => aria-192-gcm
[53] => aria-192-ofb
[54] => aria-256-cbc
[55] => aria-256-ccm
[56] => aria-256-cfb
[57] => aria-256-cfb1
[58] => aria-256-cfb8
[59] => aria-256-ctr
[60] => aria-256-ecb
[61] => aria-256-gcm
[62] => aria-256-ofb
[63] => bf-cbc
[64] => bf-cfb
[65] => bf-ecb
[66] => bf-ofb
[67] => camellia-128-cbc
[68] => camellia-128-cfb
[69] => camellia-128-cfb1
[70] => camellia-128-cfb8
[71] => camellia-128-ctr
[72] => camellia-128-ecb
[73] => camellia-128-ofb
[74] => camellia-192-cbc
[75] => camellia-192-cfb
[76] => camellia-192-cfb1
[77] => camellia-192-cfb8
[78] => camellia-192-ctr
[79] => camellia-192-ecb
[80] => camellia-192-ofb
[81] => camellia-256-cbc
[82] => camellia-256-cfb
[83] => camellia-256-cfb1
[84] => camellia-256-cfb8
[85] => camellia-256-ctr
[86] => camellia-256-ecb
[87] => camellia-256-ofb
[88] => cast5-cbc
[89] => cast5-cfb
[90] => cast5-ecb
[91] => cast5-ofb
[92] => chacha20
[93] => chacha20-poly1305
[94] => des-cbc
[95] => des-cfb
[96] => des-cfb1
[97] => des-cfb8
[98] => des-ecb
[99] => des-ede
[100] => des-ede-cbc
[101] => des-ede-cfb
[102] => des-ede-ofb
[103] => des-ede3
[104] => des-ede3-cbc
[105] => des-ede3-cfb
[106] => des-ede3-cfb1
[107] => des-ede3-cfb8
[108] => des-ede3-ofb
[109] => des-ofb
[110] => desx-cbc
[111] => id-aes128-CCM
[112] => id-aes128-GCM
[113] => id-aes128-wrap
[114] => id-aes128-wrap-pad
[115] => id-aes192-CCM
[116] => id-aes192-GCM
[117] => id-aes192-wrap
[118] => id-aes192-wrap-pad
[119] => id-aes256-CCM
[120] => id-aes256-GCM
[121] => id-aes256-wrap
[122] => id-aes256-wrap-pad
[123] => id-smime-alg-CMS3DESwrap
[124] => rc2-40-cbc
[125] => rc2-64-cbc
[126] => rc2-cbc
[127] => rc2-cfb
[128] => rc2-ecb
[129] => rc2-ofb
[130] => rc4
[131] => rc4-40
[132] => rc4-hmac-md5
[133] => seed-cbc
[134] => seed-cfb
[135] => seed-ecb
[136] => seed-ofb
[137] => sm4-cbc
[138] => sm4-cfb
[139] => sm4-ctr
[140] => sm4-ecb
[141] => sm4-ofb
)
(
[0] => aes-128-cbc
[1] => aes-128-cbc-hmac-sha1
[2] => aes-128-cbc-hmac-sha256
[3] => aes-128-ccm
[4] => aes-128-cfb
[5] => aes-128-cfb1
[6] => aes-128-cfb8
[7] => aes-128-ctr
[8] => aes-128-ecb
[9] => aes-128-gcm
[10] => aes-128-ocb
[11] => aes-128-ofb
[12] => aes-128-xts
[13] => aes-192-cbc
[14] => aes-192-ccm
[15] => aes-192-cfb
[16] => aes-192-cfb1
[17] => aes-192-cfb8
[18] => aes-192-ctr
[19] => aes-192-ecb
[20] => aes-192-gcm
[21] => aes-192-ocb
[22] => aes-192-ofb
[23] => aes-256-cbc
[24] => aes-256-cbc-hmac-sha1
[25] => aes-256-cbc-hmac-sha256
[26] => aes-256-ccm
[27] => aes-256-cfb
[28] => aes-256-cfb1
[29] => aes-256-cfb8
[30] => aes-256-ctr
[31] => aes-256-ecb
[32] => aes-256-gcm
[33] => aes-256-ocb
[34] => aes-256-ofb
[35] => aes-256-xts
[36] => aria-128-cbc
[37] => aria-128-ccm
[38] => aria-128-cfb
[39] => aria-128-cfb1
[40] => aria-128-cfb8
[41] => aria-128-ctr
[42] => aria-128-ecb
[43] => aria-128-gcm
[44] => aria-128-ofb
[45] => aria-192-cbc
[46] => aria-192-ccm
[47] => aria-192-cfb
[48] => aria-192-cfb1
[49] => aria-192-cfb8
[50] => aria-192-ctr
[51] => aria-192-ecb
[52] => aria-192-gcm
[53] => aria-192-ofb
[54] => aria-256-cbc
[55] => aria-256-ccm
[56] => aria-256-cfb
[57] => aria-256-cfb1
[58] => aria-256-cfb8
[59] => aria-256-ctr
[60] => aria-256-ecb
[61] => aria-256-gcm
[62] => aria-256-ofb
[63] => bf-cbc
[64] => bf-cfb
[65] => bf-ecb
[66] => bf-ofb
[67] => camellia-128-cbc
[68] => camellia-128-cfb
[69] => camellia-128-cfb1
[70] => camellia-128-cfb8
[71] => camellia-128-ctr
[72] => camellia-128-ecb
[73] => camellia-128-ofb
[74] => camellia-192-cbc
[75] => camellia-192-cfb
[76] => camellia-192-cfb1
[77] => camellia-192-cfb8
[78] => camellia-192-ctr
[79] => camellia-192-ecb
[80] => camellia-192-ofb
[81] => camellia-256-cbc
[82] => camellia-256-cfb
[83] => camellia-256-cfb1
[84] => camellia-256-cfb8
[85] => camellia-256-ctr
[86] => camellia-256-ecb
[87] => camellia-256-ofb
[88] => cast5-cbc
[89] => cast5-cfb
[90] => cast5-ecb
[91] => cast5-ofb
[92] => chacha20
[93] => chacha20-poly1305
[94] => des-cbc
[95] => des-cfb
[96] => des-cfb1
[97] => des-cfb8
[98] => des-ecb
[99] => des-ede
[100] => des-ede-cbc
[101] => des-ede-cfb
[102] => des-ede-ofb
[103] => des-ede3
[104] => des-ede3-cbc
[105] => des-ede3-cfb
[106] => des-ede3-cfb1
[107] => des-ede3-cfb8
[108] => des-ede3-ofb
[109] => des-ofb
[110] => desx-cbc
[111] => id-aes128-CCM
[112] => id-aes128-GCM
[113] => id-aes128-wrap
[114] => id-aes128-wrap-pad
[115] => id-aes192-CCM
[116] => id-aes192-GCM
[117] => id-aes192-wrap
[118] => id-aes192-wrap-pad
[119] => id-aes256-CCM
[120] => id-aes256-GCM
[121] => id-aes256-wrap
[122] => id-aes256-wrap-pad
[123] => id-smime-alg-CMS3DESwrap
[124] => rc2-40-cbc
[125] => rc2-64-cbc
[126] => rc2-cbc
[127] => rc2-cfb
[128] => rc2-ecb
[129] => rc2-ofb
[130] => rc4
[131] => rc4-40
[132] => rc4-hmac-md5
[133] => seed-cbc
[134] => seed-cfb
[135] => seed-ecb
[136] => seed-ofb
[137] => sm4-cbc
[138] => sm4-cfb
[139] => sm4-ctr
[140] => sm4-ecb
[141] => sm4-ofb
)
Gewijzigd op 23/04/2020 12:55:19 door Dennis WhoCares
En als je dat SMTPOptions in zijn geheel weglaat? Het lijkt mij het beste dat PHPMailer zelf onderhandelt met de SMTP-server voor acceptabele instellingen. Aan de andere kant, het moet wel duidelijk zijn/worden welke instellingen gebruikt zouden moeten worden :/.
Maar omdat je de normale SMTP-poort gebruikt houdt de onderhandeling mogelijk op bij een lager protocol, en dan hangt 'ie dus op :p. Misschien is het noodzakelijk dat je op een andere manier wat extra "hints" geeft hoe je een verbinding wilt maken omdat op grond van de poort of andere instellingen in de huidige configuratie wellicht verkeerde aannames worden gedaan die niet resulteren in het gewenste resultaat.
Zo zou je ssl:// aan je Host toe kunnen voegen, of zelfs tlsv1.2://, dit is blijkbaar een geldige stream wrapper. Of, als dit niet gaat vliegen in PHPMailer zelf, zou je dit wellicht wel kunnen gebruiken voor de voorgestelde tests hieronder. Misschien niet optimaal, maar als dat wel werkt dan heb je in ieder geval een werkende uitgangssituatie, en dat zou ook bewijzen dat het een configuratiekwestie van PHPMailer is waardoor de connectie niet tot stand kan worden gebracht (en dat sterke vermoeden bestaat al omdat het via een andere methode -ncat- wel allemaal lukt).
Weliswaar een oude thread op het PHP bug forum, en niet echt van toepassing op jouw situatie, maar dit kan wellicht inspiratie geven voor het debuggen (gebruik stream_socket_client() om een verbinding te maken en kijk hoever je komt, controleer stream_get_transports(), voeg protocol prefixes toe, kijkt wat print_r(OPENSSL_VERSION_TEXT); retourneert et cetera). Hoe meer informatie je kunt inwinnen over de configuratie en wat er onder water gebeurt, hoe dichter je waarschijnlijk bij een oplossing aanbelandt.
Gewijzigd op 23/04/2020 15:50:22 door Thomas van den Heuvel