The command line you specified just establishes a connection and it's waiting for you to do something -- I think it's working as designed. Typically you'd pipe something from STDIN to create a message, or use it as a backend for another program. <a href="http://msmtp.sourceforge.net/doc/msmtp.html">http://msmtp.sourceforge.net/doc/msmtp.html</a> good luck :-)<br clear="all">
<br>Regards,<br><br>Stephen J Alexander<br>MPBX, LLC<br><a href="http://mpbx.com" target="_blank">http://mpbx.com</a><br>832-713-6729<br>
<br><br><div class="gmail_quote">On Mon, May 14, 2012 at 2:38 PM, Scott Sjodin <span dir="ltr"><<a href="mailto:scott.sjodin@gmail.com" target="_blank">scott.sjodin@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Ok, so I found the right certificate, but when I run a test with msmtp -a default username@domain.com...it just hangs. Tried it with all three SSL ports (465, 587, 25) with the same result....what happens now? I can't troubleshoot without error messages...<div>
<br></div><div>Thanks for everyone's assistance so far.<div><div class="h5"><br><br><div class="gmail_quote">On Sun, May 13, 2012 at 10:00 PM, Ram <span dir="ltr"><<a href="mailto:ram0502@gmail.com" target="_blank">ram0502@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">> From: Scott Sjodin <<a href="mailto:scott.sjodin@gmail.com" target="_blank">scott.sjodin@gmail.com</a>><br>
> Message-ID:<br>
> <<a href="mailto:CAAfAOiWep9ZH3MCEGGtNQ0kom4fzAa%2ByaJ7qrkJgKyCuoLmsCg@mail.gmail.com" target="_blank">CAAfAOiWep9ZH3MCEGGtNQ0kom4fzAa+yaJ7qrkJgKyCuoLmsCg@mail.gmail.com</a>><br>
<div><br>
> So I've got my msmtp setup (almost). It's running. I can telnet in to<br>
> <a href="http://smtp.mydomain.com" target="_blank">smtp.mydomain.com</a> 587 and 25 and send over the creds (but not with 465)<br>
> successfully. I can run openssl, with 465 I get the following:<br>
><br>
><br>
> openssl s_client -CApath<br>
> /etc/ssl/certs/Equifax_Secure_Certificate_Authority.cer -connect<br>
> <a href="http://smtp.mydomain.com:465" target="_blank">smtp.mydomain.com:465</a><br>
><br>
> Verify return code: 20 (unable to get local issuer certificate)<br>
><br>
> When testing msmtp -a default <a href="mailto:username@domain.com" target="_blank">username@domain.com</a> I get the following<br>
> results (with port numbers corresponding to changes in the msmtprc file)<br>
><br>
><br>
> When I change up the port number to 587:<br>
><br>
> msmtp: TLS certificate verification failed: the certificate is not trusted<br>
> When I change up the port number to 25:<br>
> msmtp: TLS certificate verification failed: the certificate is not trusted<br>
> When I change up the port number to 465:<br>
> msmtp: network read error: Connection reset by peer.<br>
><br>
> My msmtprc file is listed below:<br>
><br>
> defaults<br>
> tls on<br>
> tls_starttls on<br>
> tls_trust_file /etc/ssl/certs/Equifax_Secure_Certificate_Authority.cer<br>
><br>
> #this was downloaded direct from GeoTrust's website -<br>
> #<a href="http://www.geotrust.com/resources/root-certificates/index.html" target="_blank">http://www.geotrust.com/resources/root-certificates/index.html</a><br>
<br>
</div>I suspect the server does not have it's certificate installed properly<br>
- specifically the intermediate or chain certificate is probably not<br>
installed/configured. Ideally this would be fixed on the server side<br>
but you can work around it by adding the correct chain certificate(s)<br>
to the client trusted certificate list.<br>
<br>
As a test try going to that same port and dump the certificates it<br>
offers up like so:<br>
# openssl s_client -connect example.com.:443<br>
<br>
You should see a section in the output like so:<br>
---<br>
Certificate chain<br>
0 s:/serialNumber=1234/C=US/O=<a href="http://example.com/OU=NoAuthFromUs/OU=Seesomeurl/cps" target="_blank">example.com/OU=NoAuthFromUs/OU=See<br>
someurl/cps</a> (c)11/OU=Domain Control Validated -<br>
RapidSSL(R)/CN=<a href="http://example.com" target="_blank">example.com</a><br>
i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA<br>
1 s:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA<br>
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA<br>
2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA<br>
i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority<br>
<br>
<br>
You should see three entries (0, 1, 2) though the names will be<br>
different than above. If you only see two then the the chain<br>
certificate is missing from the server.<br>
<br>
cheers<br>
</blockquote></div><br></div></div></div>
</blockquote></div><br>