eclipse-ee4j / eclipse-ee4j/angus-mail

"mail.smtp.ssl.trust" seems to be broken

Open
#187 10 comments 0 reactions 1 assignee Claimed by @jbescos View on GitHub
bug
Dominant language
Java
Stars
87
Forks
23
PR merge metrics
No merged PRs in 30d

Description

**artifact**: org.eclipse.angus:jakarta-mail:2.0.5

**Describe the bug**
I have a mail server configured via starttls. Due to internal routing the domain name does not match with the certificate common name.

> If set to "*", all hosts are trusted. [...] Otherwise, trust depends on the certificate the server presents.
Souce: https://jakarta.ee/specifications/mail/1.6/apidocs/com/sun/mail/smtp/package-summary

So from my understanding setting "mail.smtp.ssl.trust" to "*" should ignore the certificate the server presents.

But I still get a `MessagingException`:
```
Could not convert socket to TLS
jakarta.mail.MessagingException: Could not convert socket to TLS;
nested exception is:
javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching domain.tld found.
at app//org.eclipse.angus.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2173)
at app//org.eclipse.angus.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:741)
at app//jakarta.mail.Service.connect(Service.java:345)
at app//org.springframework.mail.javamail.JavaMailSenderImpl.connectTransport(JavaMailSenderImpl.java:480)
at app//org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:399)
at app//org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:317)
at app//org.springframework.mail.MailSender.send(MailSender.java:42)
at app//it.impl.email.service.JavaMailSenderFactory2Test.test(JavaMailSenderFactory2Test.java:35)
at java.base@21.0.8/java.lang.reflect.Method.invoke(Method.java:580)
at java.base@21.0.8/java.util.ArrayList.forEach(ArrayList.java:1596)
at java.base@21.0.8/java.util.ArrayList.forEach(ArrayList.java:1596)
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching domain.tld found.
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:130)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1327)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1204)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1147)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:393)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:476)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:447)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
at org.eclipse.angus.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:662)
at org.eclipse.angus.mail.util.SocketFetcher.startTLS(SocketFetcher.java:563)
at org.eclipse.angus.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2168)
... 10 more
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching domain.tld found.
at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:207)
at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:470)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:417)
at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1463)
at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1431)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1311)
... 24 more
```

Currently `mail.smtp.ssl.trust` seems just to work in combination with `mail.smtp.ssl.checkserveridentity` set to `false`.

If this is the intended behaviour at least the documentation appears confusing to me.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.