eclipse-ee4j / eclipse-ee4j/angus-mail
"mail.smtp.ssl.trust" seems to be broken
- Dominant language
- Java
- Stars
- 87
- Forks
- 23
- PR merge metrics
- No merged PRs in 30d
Description
**artifact**: org.eclipse.angus:jakarta-mail:2.0.5
**Describe the bug**
I have a mail server configured via starttls. Due to internal routing the domain name does not match with the certificate common name.
> If set to "*", all hosts are trusted. [...] Otherwise, trust depends on the certificate the server presents.
Souce: https://jakarta.ee/specifications/mail/1.6/apidocs/com/sun/mail/smtp/package-summary
So from my understanding setting "mail.smtp.ssl.trust" to "*" should ignore the certificate the server presents.
But I still get a `MessagingException`:
```
Could not convert socket to TLS
jakarta.mail.MessagingException: Could not convert socket to TLS;
nested exception is:
javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching domain.tld found.
at app//org.eclipse.angus.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2173)
at app//org.eclipse.angus.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:741)
at app//jakarta.mail.Service.connect(Service.java:345)
at app//org.springframework.mail.javamail.JavaMailSenderImpl.connectTransport(JavaMailSenderImpl.java:480)
at app//org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:399)
at app//org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:317)
at app//org.springframework.mail.MailSender.send(MailSender.java:42)
at app//it.impl.email.service.JavaMailSenderFactory2Test.test(JavaMailSenderFactory2Test.java:35)
at java.base@21.0.8/java.lang.reflect.Method.invoke(Method.java:580)
at java.base@21.0.8/java.util.ArrayList.forEach(ArrayList.java:1596)
at java.base@21.0.8/java.util.ArrayList.forEach(ArrayList.java:1596)
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching domain.tld found.
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:130)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1327)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1204)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1147)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:393)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:476)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:447)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
at org.eclipse.angus.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:662)
at org.eclipse.angus.mail.util.SocketFetcher.startTLS(SocketFetcher.java:563)
at org.eclipse.angus.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2168)
... 10 more
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching domain.tld found.
at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:207)
at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:470)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:417)
at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1463)
at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1431)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1311)
... 24 more
```
Currently `mail.smtp.ssl.trust` seems just to work in combination with `mail.smtp.ssl.checkserveridentity` set to `false`.
If this is the intended behaviour at least the documentation appears confusing to me.
Contributor guide
Assessment
This issue has not been assessed yet.