1

Sparkpost announced depreciation of TLS 1.0. We use SMTP PRO Magento plugin. It looks like after testing against non TLS 1.0 endpoint, the connection fails.

I'm not sure where to even look to upgrade the plugin. Can anybody point me to articles on what are the difference in code between a TLS 1.0 and TLS 1.1 connections?

UPDATE:

I tried adding:

STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT

In:

 /var/www/html/mysite.com/lib/Zend/Mail/Protocol/Smtp.php:211

// If a TLS session is required, commence negotiation
    if ($this->_secure == 'tls') {
        $this->_send('STARTTLS');
        $this->_expect(220, 180);
        if (!stream_socket_enable_crypto($this->_socket, true, STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT |
                       STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT)) {
            /**
             * @see Zend_Mail_Protocol_Exception
             */
            #require_once 'Zend/Mail/Protocol/Exception.php';
            throw new Zend_Mail_Protocol_Exception('Unable to connect via TLS');
        }
        $this->_ehlo($host);
    }

I'm getting the same response.

UPDATE: Checked if my server supports TLS 1.2

openssl ciphers -v | awk '{print $2}' | sort | uniq

Result:

SSLv3
TLSv1.2

So it must be Zend version that is having issues with TLS. Going to dig deeper.

UPDATE:

Tried connecting directly to the test endpoint from console:

 openssl s_client -connect no-tlsv1-test-smtp.sparkpostmail.com:587 -tls1_2

I'm getting this:

CONNECTED(00000003)
140650349737800:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
   Protocol  : TLSv1.2
   Cipher    : 0000
   Session-ID:
   Session-ID-ctx:
   Master-Key:
   Key-Arg   : None
   Krb5 Principal: None
   PSK identity: None
   PSK identity hint: None
   Start Time: 1530722868
   Timeout   : 7200 (sec)
   Verify return code: 0 (ok)

UPDATE:

Looking at the server, CURL currently operates daily with TLS 1.2 through Authorize.net - so it's not the server.

My server admin also noticed we are using old version of PHP. So upgrading PHP to 5.6 might resolve the issue.

What we noticed is that old PHP version doesnt have STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT or STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT constants - which both of them are introduced in PHP 5.6 according to:

http://php.net/manual/en/function.stream-socket-enable-crypto.php

So I'm looking to upgrade to PHP 5.6 from what it looks like.

1 Answer 1

2

Found the solution:

The server needed to be updated to PHP 5.6.

STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT constant is only available in PHP 5.6 and I couldnt find an alternative to stream_socket_enable_crypto function in time.

Final code:

/var/www/html/mysite.com/lib/Zend/Mail/Protocol/Smtp.php:211

// If a TLS session is required, commence negotiation
if ($this->_secure == 'tls') {
    $this->_send('STARTTLS');
    $this->_expect(220, 180);
    if (!stream_socket_enable_crypto($this->_socket, true, STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT)) {
        /**
         * @see Zend_Mail_Protocol_Exception
         */
        #require_once 'Zend/Mail/Protocol/Exception.php';
        throw new Zend_Mail_Protocol_Exception('Unable to connect via TLS');
    }
    $this->_ehlo($host);
}
6
  • I see this code is already present in my files, but still i get the same error. I am running magento on my local machine (mac mountain lion, with php 5.6) Commented Mar 9, 2019 at 4:10
  • on wamp I had to add SSL support to php.ini. Search google for something like add SSL to localhost / wamp / xampp. Something like this shellcreeper.com/how-to-create-valid-ssl-in-localhost-for-xampp Commented Mar 10, 2019 at 6:03
  • 1
    Thanks for this. We had some issues with TLS versions on our Magento 1 site (using SMTP Pro) - simply changing STREAM_CRYPTO_METHOD_TLS_CLIENT to STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT meant it started working right away. I owe you big Kalvin. Commented Oct 22, 2021 at 12:57
  • 1
    @ThomasHarding there's that UP ARROW button on the answer ;) Commented Oct 22, 2021 at 16:07
  • Thanks much! This saved the day for me when I realized our outbound email via our Microsoft 365 shared mailbox had stopped working. Commented Jan 26, 2022 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.