Some mails don't make it to its destination

[Aschweti]

Hi there,

I have a big problem with two SUSE 9.0 servers which have qmail and vpopmail installed. I followed the qmailrocks tutorial. Everything seems to work fine except some servers do not accept mail from my servers. So I get e.g.


TLS found no client cert in control/clientcert.pem I'm not going to try again; this message has been in the queue too long.


This comes from the Deutsche Bank server and also from Hosteurope. The Deutsche Bank support replied with the following:


> Looks like a client issue. I suspect it sees that we offer TLS and
> searches desperately for a certificate.

> AFAIK qmail doesn't come with TLS support so it may be some unsupported
> patch.

> It's either a configuration problem, i.e. requiring client authentication,
> or a bug in the patch that it doesn't fail over to
> - unauthenticated encrypted
> - plain without starttls


I also sometimes get sending mails to AOL....


"Sorry, I wasn't able to establish an SMTP connection. (#4.4.1) I'm not going to try again; this message has been in the queue too long."


This might be do to some AOL filters?

The first issue is by far the bigger problem!

I searched hours now and I checked the certificate, the rights, etc. Everything seems to be fine.


kundenserver:~ # telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.digital4u.de ESMTP
ehlo localhost
250-mail.digital4u.de
250-AUTH LOGIN CRAM-MD5 PLAIN
250-AUTH=LOGIN CRAM-MD5 PLAIN
250-STARTTLS
250-PIPELINING
250 8BITMIME
starttls
220 ready for tls
exit


Somebody must have had the same problems, especially as this occurs on both of our servers?!

Any help is highly appreciated!

Best regards,

Alex

[esarakaitis]

did you create the clientcert.pem? what are the permissions of it?

[Aschweti]

Yes I created it. User is "vpopmail", group is "vchkpw". File permissions are "640".

Doing a openssl "verify /var/qmail/control/clientcert.pem" returns:


/var/qmail/control/clientcert.pem: /C=DE/ST=Hessen/L=Wiesbaden/O=DIGITAL FOR YOU/OU=Mail/CN=mail.digital4u.de/emailAddress=webmaster@digital4u.de
error 18 at 0 depth lookup:self signed certificate
OK


...which is OK what I have read?

Best regards,

Alex

[Aschweti]

By the way, I have read somehwere else changing user and group to "root" and change file permissions to "444". I just gave that a try and if I am not wrong the mail to Hosteurope went through.

If that is the solution, is a way to go known by you Pro's? Could this cause problems at other ends?

This is where the "444-solution" comes from and reading down they don't believe it's the best solution...

http://listarchive.qmailrocks.org/message/20040901.190405.5ceec882.html

Again, I am not sure yet if it really went through.

I will be happy to get your advises ;-)

Thanks again Alex