in reply to Net::SMTP::SSL ACK!!

I will share with you the ultimate wisdom of SSL/TLS debugging. Anytime you find yourself saying, "why has my SSL/TLS session failed to be established?", all you need to do is insert this line at the top of your script (before any other modules are loaded):

use IO::Socket::SSL qw(debug3);

This will give you a trace of the attempted establishment of the SSL/TLS session and will give at least some clue as to where the error lies. As often as not it will be "certificate verify failed" and you'll need to examine the certs carefully to see why but at least it will give that clue as to where to start looking.

I hope that this is useful to you.

Replies are listed 'Best First'.
Re^2: Net::SMTP::SSL ACK!!
by Dandello (Monk) on Jan 29, 2016 at 17:15 UTC
    Thanks: This is the Debug trace
    DEBUG: .../IO/Socket/SSL.pm:1653: new ctx 143739952 DEBUG: .../IO/Socket/SSL.pm:363: socket not yet connected DEBUG: .../IO/Socket/SSL.pm:1328: IO::Socket::INET6 configuration fail +ed error:00000000:lib(0):func(0):reason(0) DEBUG: .../IO/Socket/SSL.pm:1690: free ctx 143739952 open=143739952 DEBUG: .../IO/Socket/SSL.pm:1698: OK free ctx 143739952
    Now off to figure out what this: DEBUG: .../IO/Socket/SSL.pm:1328: IO::Socket::INET6 configuration failed error:00000000:lib(0):func(0):reason(0) means... Okay, I think I know that the problem is - there IS a problem with the SSL certs and it no doubt relates to the fact that you can have only 1 working https domain per IP address.
      This looks for me not like a problem at the SSL level but at the plain socket level, i.e. that the TCP connection to smtp.gmail.com port 465 already fails.
        So I'm still missing some element (or there's something wrong) in
        my $mailer = new Net::SMTP::SSL( $smtp_server, Hello => 'mydomain.com', Port => $port, Debug => 1, layer=> 'ssl', );
        I've gone through the documentation for Net::SMTP::SSL and except for the layer => 'ssl' parameter, everything looks like the examples. Luckily this code isn't mission critical and I can fall back to TLS, but it would be nice to have it work with SSL.
      #!/usr/bin/perl use strict; use warnings; use Net::SMTPS; use CGI::Carp qw(fatalsToBrowser); use English '-no_match_vars'; our @ARGV = ( 'me_at@gmail.com', 'mypassword', 'tosombody@forumsoftwar +e.com', 'me_at@gmail.com' ); my $body = "Test message"; my $headers = "Content-Type: text/plain\r\n\r\n"; my $smtp_server = 'smtp.gmail.com'; my $port = 587; my $ssl = 'starttls'; # 'ssl' / 'starttls' / undef my $mailer = new Net::SMTPS( $smtp_server, Hello => 'host.mydomain.net', Port => $port, Debug => 1, doSSL => $ssl, ) || die "Unable to create Net::SMTPS object. Server: '$smtp_serve +r', port '$port'\n\n" . $OS_ERROR; $mailer->auth($ARGV[0], $ARGV[1]); $mailer->mail($ARGV[3]); $mailer->to($ARGV[2]); $mailer->data(); $mailer->datasend("Subject: SMTP test\r\n\r\n" . $headers . $body); $mailer->dataend; $mailer->quit; print "Content-type: text/html\n\n" or croak 'cannot print line1'; print "Complete"; exit();

      Okay - the above works (and it's not Net::SMTP::TLS). Yes, I know Net::SMTPS is also old and deprecated BUT I found another complication last night. CPanel still ships with Perl 5.8.8 so my code has to work with Perl 5.8.8

      Another annoyance - The docs for Net::SMTP 3.03 say this:

      B<Port> - port to connect to. Default - 25 for plain SMTP and 465 for immediate SSL. B<SSL> - If the connection should be done from start with SSL, contrar +y to later upgrade with C<starttls>. You can use SSL arguments as documented in L<IO::Socket::SSL>, but it +will usually use the right arguments already.
      But that requires at least IO::Socket::SSL 2.007 and that is well above the version 1.79 that Perl 5.8.8 seems to support. Or at least above the version that I can get CPanel to install.

      So, any hints on how to explicitly tell Net::SMTP 3.03 that it's supposed to tell IO::Socket::SSL 1.79 to start starttls.

        Yes, I know Net::SMTPS is also old and deprecated

        AFAICT Net::SMTPS is neither old nor deprecated. Perhaps you are confusing it with something else?

        > But that requires at least IO::Socket::SSL 2.007 and that is well above the version 1.79 that Perl 5.8.8 seems to support. Or at least above the version that I can get CPanel to install.
        > So, any hints on how to explicitly tell Net::SMTP 3.03 that it's supposed to tell IO::Socket::SSL 1.79 to start starttls.

        I think that if you are still using a system with 5.8.8 then you will probably run into more problems, like missing support for newer TLS versions etc. Apart from that current IO::Socket::SSL should still run with 5.8.8 but you have to install it and probably even newer versions of Net::SSLeay. Trying to enforce use of the very old version 1.79 will not work because it needs features of the newer versions.

        I guess your problems are more related to the use of very old and for years unsupported code and you better should upgrade instead of trying to work around all these problems.