Hide Forgot
Description of problem: Right now notifier probably[1] cannot use only dedicated SSL port. Be modern and use STARTTLS. Please do not force one to use AUTH for SSL/STARTTLS. For example AUTH is not required in our internal company smtp server, but it advertise STARTTLS. Other bugs may block this: BZ1020900, BZ1020908. 1 - not 100% sure because of BZ1020900 Version-Release number of selected component (if applicable): is19 How reproducible: 100% Steps to Reproduce: 1. test with internal smtp server, it uses 587 with STARTTLS advertised and does not need/advertise AUTH 2. 3. Actual results: Expected results: Additional info:
Arthur?
Is this the same as BZ1020908?
(In reply to Arthur Berezin from comment #2) > Is this the same as BZ1020908? I don't think it's exactly the same. This is about using STARTTLS in order not to use a dedicated SSL port or have one required, if i understand correctly.
Actually I saw an example where authentication is required altough using STARTLS.
ovirt 3.4.0 alpha has been released
Created attachment 855998 [details] notifier.log fail, ovirt-engine-tools-3.4.0-0.2.master.20140112020439.git9ad8529.el6.noarch 2014-01-27 09:58:07,809 ERROR [org.ovirt.engine.core.notifier.utils.sender.mail.JavaMailSender] Failed to send message to jbelka with subject Issue Solved Notification. (jb-rh34.rhev.lab.eng.brq.redhat.com), [Host dell-r210ii-13 was activated by admin@internal.] due to to error: Could not convert socket to TLS javax.mail.MessagingException: Could not convert socket to TLS; nested exception is: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:1880) at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:648) at javax.mail.Service.connect(Service.java:317) at javax.mail.Service.connect(Service.java:176) at javax.mail.Service.connect(Service.java:125) at javax.mail.Transport.send0(Transport.java:194) at javax.mail.Transport.send(Transport.java:124) at org.ovirt.engine.core.notifier.utils.sender.mail.JavaMailSender.send(JavaMailSender.java:111) at org.ovirt.engine.core.notifier.utils.sender.mail.EventSenderMailImpl.send(EventSenderMailImpl.java:79) at org.ovirt.engine.core.notifier.NotificationService.processEvents(NotificationService.java:266) at org.ovirt.engine.core.notifier.NotificationService.run(NotificationService.java:121) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471) at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:304) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:178) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) ...
[root@jb-rh34 ~]# /usr/share/ovirt-engine/bin/java-home /usr/lib/jvm/jre [root@jb-rh34 ~]# /usr/lib/jvm/jre/bin/java -version java version "1.7.0_51" OpenJDK Runtime Environment (rhel-2.4.4.1.el6_5-x86_64 u51-b02) OpenJDK 64-Bit Server VM (build 24.45-b08, mixed mode)
It's not the problem of the feature but it's the problem CA that signed certificate for smpt.corp.redhat.com. This Red Hat IS CA is not one of valid CA included in Java SDK cacerts file, so that's the cause of error. I tested this with Gmail account which it's certificate signed by Equifax Secure Certificate Authority, which is included in cacerts and everything works fine. So if you want to use SSL/TLS with SMTP and you have self-signed certificate or certificate not signed by one of world known CA's you have to add CA's public cert into cacerts file. Btw this behavior is not changed by adding STARTTLS feature, you have same problem with SMTPS connections certificates.
If your SMTP server uses self signed certificate or certificate signed by your own CA, you have to add server certificate or your CA certificate into Java cacerts file using this command: keytool -importcert -keystore /usr/lib/jvm/jre-1.7.0-openjdk.x86_64/lib/security/cacerts -trustcacerts -file /tmp/your_ca.crt -alias yourca Please adapt path to cacerts file for your environment.
ok, ovirt-engine-tools-3.4.0-0.2.master.20140112020439.git9ad8529.el6.noarch Received: from jb-rh34.rhev.lab.eng.brq.redhat.com ([10.34.63.78]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s0SDOQWL007092 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO)
Closing as part of 3.4.0