6

Just want to throw this question here so the answers can be easily found by people who met similar problems.

Problem came up when we were trying to test some new mailing services with CiviCRM 4.7, we kept getting "connection refused" errors and other similar messages with different protocols and ports entered in outbound mail settings.

The environment we have: Ubuntu 14.04, php 5.6, Drupal 7.3.x, CiviCRM 4.7.x.

  • A duplicate over here? – Chris Burgess Apr 7 '16 at 10:12
  • 1
    Disabling SSL peer verification is, to me, like taking the bulb out of a warning light to "fix" a problem with your engine. Please get the underlying issue fixed instead 😉 – Chris Burgess Mar 30 '17 at 2:08
14

PHP5.6 has enabled peer verification by default from 5.6.x. The most likely cause of this issue is that the SMTP server's SSL cert does not validate against the certs available to the hosting environment.

So, on PHP5.6+, an SMTP connection via SSL and TLS will fail in CiviCRM if the certificates are not peer verified. This is an issue either with the SMTP provider or your hosting environment's CA chain.

It is recommended instead to resolve the underlying issues with your hosting/SMTP service, but if you want to connect to a server with a self signed certificate (for example) you can patch CiviCRM to bypass this verification.

Change in packages/Net/SMTP.php

line $this->_socket_options = $socket_options;

to $this->_socket_options = array('ssl' => array('verify_peer_name' => false));

Updated: I have updated the comment here since the summary in the ref link has also been updated to include:

While not recommended in general, it is possible to disable peer certificate verification for a request by setting the verify_peer context option to FALSE, and to disable peer name validation by setting the verify_peer_name context option to FALSE.

The above works around the problem with SMTP failure however it is better to ensure the server is set up with valid SSL certificate and configurations.

  • Are you sure all SMTP using TLS will fail, or just those using self-signed certificates which fail peer validation? Or hosting environments with outdated CA on the server. – Chris Burgess Apr 7 '16 at 10:11
  • Works for me with SMTP via GMail. Thanks! – Christian Wach Apr 11 '16 at 10:50
  • 1
    I just ran into this as well. Should we be pushing to get this into core? – lcdservices Aug 5 '16 at 19:18
  • 1
    "Since php has enabled peer verification by default from 5.6.x, all the SMTP connection via SSL and TLS will fail in CiviCRM." <-- Not true! If the certificates have been set up properly peer verification should pass. – michaelmcandrew Mar 22 '17 at 14:50
  • 3
    IMO this answer is bad advice (telling people to disable builtin security functionality to avoid hearing about issues in the hosting / SMTP environment). Since it has lots of upvotes, I've modified it to nudge people to a better solution, without wholesale rewriting the answer. I recommend people use Michael's solution instead. – Chris Burgess Mar 30 '17 at 2:06
7

I had to go this far...

$this->_socket_options = array('ssl' => array('verify_peer'=>false,'verify_peer_name'=>false,'allow_self_signed'=>true));
  • FWIW, if you are connecting to well known third party mail provider, then it's highly likely that they have their certificates set up properly and you shouldn't need to disable peer verification. – michaelmcandrew Jan 12 '18 at 13:05
6

If you are connecting to well known third party mail provider, then it's highly likely that they have their certificates set up properly and you shouldn't need to disable peer verification.

Check two things:

  1. As it mentions on the Settings - Outbound Mail form, 'if the server uses SSL, add "ssl://" to the beginning of the server name'.

  2. Check what port you are using: "The most common SMTP port possibilities are 25, 465, and 587".

And if the above does not resolve the issue, verify that the hosting environment's CA chain is up to date, since that will also trigger this problem.

Note: In the case of Mandrill, even though the https://mandrillapp.com/settings page specified port 587, ssl only worked on port 465 (as explainined in this mandrill knowledge base article).

  • 2
    3. verify that the hosting environment's CA chain is up to date, since that will also trigger this problem – Chris Burgess Mar 30 '17 at 2:02
  • 1
    PS. Yours is the correct answer, but the one recommending to disable peer verification has lots of votes 😡 – Chris Burgess Mar 30 '17 at 2:03
  • 1
    Plus a zillion for not disabling peer verification! To speak directly to an example comment above our cert, ports, etc are set up properly and we have never had an issue connecting with Sparkpost using php 5.6.3. – Eli Lisseck Mar 30 '17 at 2:15
  • @chris and eli - might want to consider voting up the comments in the wrong answer as well so they are above the comment fold to help others. – michaelmcandrew Mar 31 '17 at 14:26
  • @EliLisseck how are you connecting to Sparkpost? I'm trying to figure out why it's not working for us. We're using Sparkpost, Let's Encrypt, and the PESC Sparkpost extension. The extension builders say it's a core Civi issue: github.com/proexchange/com.pesc.sparkpost/issues/22 – herb May 19 '17 at 20:44
0

Seems there is some work in progress to attach this on CRM-18408 SMTP connection via SSL and TLS in PHP 5.6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.