6

Just want to throw this question here so the answers can be easily found by people who met similar problems.

Problem came up when we were trying to test some new mailing services with CiviCRM 4.7, we kept getting "connection refused" errors and other similar messages with different protocols and ports entered in outbound mail settings.

The environment we have: Ubuntu 14.04, php 5.6, Drupal 7.3.x, CiviCRM 4.7.x.

Improve this question
2
  • A duplicate over here?
    – Chris Burgess
    Apr 7, 2016 at 10:12
  • 1
    Disabling SSL peer verification is, to me, like taking the bulb out of a warning light to "fix" a problem with your engine. Please get the underlying issue fixed instead 😉
    – Chris Burgess
    Mar 30, 2017 at 2:08

4 Answers 4

Reset to default
15

PHP5.6 has enabled peer verification by default from 5.6.x. The most likely cause of this issue is that the SMTP server's SSL cert does not validate against the certs available to the hosting environment.

So, on PHP5.6+, an SMTP connection via SSL and TLS will fail in CiviCRM if the certificates are not peer verified. This is an issue either with the SMTP provider or your hosting environment's CA chain.

It is recommended instead to resolve the underlying issues with your hosting/SMTP service, but if you want to connect to a server with a self signed certificate (for example) you can patch CiviCRM to bypass this verification.

Change in packages/Net/SMTP.php

line $this->_socket_options = $socket_options;

to $this->_socket_options = array('ssl' => array('verify_peer_name' => false));

Updated: I have updated the comment here since the summary in the ref link has also been updated to include:

While not recommended in general, it is possible to disable peer certificate verification for a request by setting the verify_peer context option to FALSE, and to disable peer name validation by setting the verify_peer_name context option to FALSE.

The above works around the problem with SMTP failure however it is better to ensure the server is set up with valid SSL certificate and configurations.

Improve this answer
10
  • Are you sure all SMTP using TLS will fail, or just those using self-signed certificates which fail peer validation? Or hosting environments with outdated CA on the server.
    – Chris Burgess
    Apr 7, 2016 at 10:11
  • Works for me with SMTP via GMail. Thanks!
    – Christian Wach
    Apr 11, 2016 at 10:50
  • 1
    I just ran into this as well. Should we be pushing to get this into core?
    – lcdservices
    Aug 5, 2016 at 19:18
  • 1
    "Since php has enabled peer verification by default from 5.6.x, all the SMTP connection via SSL and TLS will fail in CiviCRM." <-- Not true! If the certificates have been set up properly peer verification should pass.
    – michaelmcandrew
    Mar 22, 2017 at 14:50
  • 3
    IMO this answer is bad advice (telling people to disable builtin security functionality to avoid hearing about issues in the hosting / SMTP environment). Since it has lots of upvotes, I've modified it to nudge people to a better solution, without wholesale rewriting the answer. I recommend people use Michael's solution instead.
    – Chris Burgess
    Mar 30, 2017 at 2:06
7

I had to go this far...

$this->_socket_options = array('ssl' => array('verify_peer'=>false,'verify_peer_name'=>false,'allow_self_signed'=>true));
Improve this answer
1
  • FWIW, if you are connecting to well known third party mail provider, then it's highly likely that they have their certificates set up properly and you shouldn't need to disable peer verification.
    – michaelmcandrew
    Jan 12, 2018 at 13:05
6

If you are connecting to well known third party mail provider, then it's highly likely that they have their certificates set up properly and you shouldn't need to disable peer verification.

Check two things:

  1. As it mentions on the Settings - Outbound Mail form, 'if the server uses SSL, add "ssl://" to the beginning of the server name'.

  2. Check what port you are using: "The most common SMTP port possibilities are 25, 465, and 587".

And if the above does not resolve the issue, verify that the hosting environment's CA chain is up to date, since that will also trigger this problem.

Note: In the case of Mandrill, even though the https://mandrillapp.com/settings page specified port 587, ssl only worked on port 465 (as explainined in this mandrill knowledge base article).

Improve this answer
6
  • 2
    3. verify that the hosting environment's CA chain is up to date, since that will also trigger this problem
    – Chris Burgess
    Mar 30, 2017 at 2:02
  • 1
    PS. Yours is the correct answer, but the one recommending to disable peer verification has lots of votes 😡
    – Chris Burgess
    Mar 30, 2017 at 2:03
  • 1
    Plus a zillion for not disabling peer verification! To speak directly to an example comment above our cert, ports, etc are set up properly and we have never had an issue connecting with Sparkpost using php 5.6.3.
    – Eli Lisseck
    Mar 30, 2017 at 2:15
  • @chris and eli - might want to consider voting up the comments in the wrong answer as well so they are above the comment fold to help others.
    – michaelmcandrew
    Mar 31, 2017 at 14:26
  • @EliLisseck how are you connecting to Sparkpost? I'm trying to figure out why it's not working for us. We're using Sparkpost, Let's Encrypt, and the PESC Sparkpost extension. The extension builders say it's a core Civi issue: github.com/proexchange/com.pesc.sparkpost/issues/22
    – herb
    May 19, 2017 at 20:44
0

Seems there is some work in progress to attach this on CRM-18408 SMTP connection via SSL and TLS in PHP 5.6

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.