Cannot start TLS: handshake failure while deliver mail to mailbox

starlord7766

Hi all,
I've performed a fresh installation of grommunio and successfully set up the most important configurations, such as organization, domain, users from LDAP, SMTP relay host, and fetchmail.

Sending mail from Grommunio via the relay host (strato) works perfectly using SSL.

Fetchmail also retrieves the mails without any problems and attempts to deliver them to the mailboxes.

However, I am now encountering the problem that the postfix protocol gives me the message:

Cannot start TLS: handshake failure

and therefore cannot deliver the emails. The emails are set to

deferred .

I've made the following settings in smtp.cfg:

lda_listen_port=24
lda_listen_tls_port=465
default_domain=<domain>
smtp_certificate_path=/etc/grommunio-common/ssl/server-bundle.pem
smtp_private_key_path=/etc/grommunio-common/ssl/server.key
lda_log_level=6
smtp_support_starttls=true

When I try to access port 24 via openssl, I get an SSL response.

However, the following entry is also present in the postfix log

warning: TLS library problem: error:0A00010B:SSL routines::wrong version number:ssl/record/ssl3_record.c:355:

for the archive.

Are these two issues related, or should they be considered separately?

What settings do I need to configure so that emails can be delivered to the mailbox?

I would be grateful for any help.

Andreas

zen5556

First, configure Postfix to use TLS 1.2/1.3*by adding these lines to main.cf:

smtpd_tls_protocols = TLSv1.2 TLSv1.3
smtp_tls_protocols = TLSv1.2 TLSv1.3
smtp_tls_security_level = encrypt

Also, check your certificate files, cipher suites, and port 465 for proper SMTPS settings. Use openssl to verify remote server compatibility.

Also see if this guide helps - https://certera.com/blog/how-to-fix-ssl-handshake-failed-error/

starlord7766

Thank‘s for your response.

I‘ve set the following entry‘s

smtp_tls_protocols = >=TLSv1.2, <=TLSv1.3
smtpd_tls_protocols = >=TLSv1.2, <=TLSv1.3
smtp_tls_security_level = encrypt
smtpd_tls_security_level = encrypt

with no changes.

When I check the connection with

openssl s_client —connect [::1]:24 -starttls smtp

I get the message:

unable to get local issuer certificate

It seems to be, that this is the main problem and the root certificate is not present.

I‘m using a letsencrypt certificate.
How and where I‘m able to download it ?

WalterH

For Postfix with SSL/TLS in both directions, you need this lines in /etc/postfix/main.cf

smtp_use_tls = yes
#smtp_tls_loglevel = 0
smtp_enforce_tls = no
smtp_tls_security_level = may
smtp_tls_CAfile =
smtp_tls_CApath =
smtp_tls_cert_file = /etc/grommunio-common/ssl/server-bundle.pem
smtp_tls_key_file = /etc/grommunio-common/ssl/server.key
smtp_tls_session_cache_database =
smtp_tls_mandatory_protocols  = >=TLSv1.2, <=TLSv1.3
smtp_tls_protocols            = >=TLSv1.2, <=TLSv1.3
#
smtpd_use_tls = yes
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtpd_tls_CAfile =
smtpd_tls_CApath =
smtpd_tls_cert_file = /etc/grommunio-common/ssl/server-bundle.pem
smtpd_tls_key_file = /etc/grommunio-common/ssl/server.key
smtpd_tls_ask_ccert = no
smtpd_tls_exclude_ciphers = RC4
smtpd_tls_received_header = yes
smtpd_tls_mandatory_protocols = >=TLSv1.2, <=TLSv1.3
smtpd_tls_protocols           = >=TLSv1.2, <=TLSv1.3

Verify, that this lines exist in your main.cf file and restart postfix.

starlord7766

Thank‘s all for your reply,

I‘ve solved the issue.

In smtp.cfg I‘ve configured 465 as port for smtp over ssl and in main.cfg I‘ve set

virtual_transport=smtp:[::1]:24

but it has to be

virtual_transport=smtp:[::1]:465

as confogured.

After correcting it, it works.

Regards

Andreas

WalterH

starlord7766 virtual_transport=smtp:[::1]:24

TCP port 24 is the default port for grommunio and should not be changed. You may encounter other issues in the future if you change the default port.

starlord7766

I tested these settings and re-entered the default port 24, but when I test sending an email via STRATO, I get the following entries in the log:

D0283677E4F: lost connection with smtp.strato.de[81.169.145.133] while receiving the initial server greeting

I also get the following messages:

/usr/sbin/postconf: warning: /etc/postfix/main.cf: unused parameter: smtpd_tls_mandantory_protocols=>=TLSv1.2, <=TLSv1.3

With these settings, however, the emails are transferred to the archive without any problems.

Port 24 still reports the following when delivering emails that were retrieved via fetchmail:

[2025-12-27 15:43:05.165716]: SSL_connect error to ::1[::1]:24: -1
[2025-12-27 15:43:05.165852]: warning: TLS library problem: error:0A00010B:SSL routines::wrong version number:ssl/record/ssl3_record.c:355:

Only switching to port 465 allows reception via fetchmail, but then the transfer to the archive with port 24 fails.

Regards

Andreas

WalterH

You stated:

In smtp.cfg I‘ve configured 465 as port for smtp over ssl and in main.cfg I‘ve set
virtual_transport=smtp:[::1]:24
but it has to be
virtual_transport=smtp:[::1]:465

This is how grommunio sends mails to postfix (his MTA) and should not be changed.

You need to configure postfix to send mails via TCP:465 to your providers mailserver.

starlord7766

I've set up

smtp.strato.de:465

already in sasl_passwd and in main.cfg

relayhost=smtp.strato.de:465

Is there another configuration for these relay host ?

Regards Andreas