Cant send mails per SMTP cause of "Wrong version number"

How to Use GitLab Self-managed
1

Problem to solve

If I want to send a mail per test command I get the following error:

image
image1624Ă—328 13 KB

My smtp server is a mailcow container that supports tls v1.2 and v1.3

Steps to reproduce

I did refer to the documentation for smtp using a mailcow server but that did also not work.

Configuration

TZ=Europe/Berlin
GITLAB_SMTP_PORT=587
GITLAB_SMTP_ENABLE=true
GITLAB_TIMEZONE=Europe/Berlin
GITLAB_STARTTLS_AUTO=false
GITLAB_SMTP_TLS=true
GITLAB_SMTP_AUTH=login
GITLAB_SMTP_SSL_VERFIY=none
GITLAB_SMTP_DOMAIN=mail.***
GITLAB_SMTP_USER_NAME=noreply@***
GITLAB_SMTP_PASSWORD=*******
GITLAB_EMAIL_FROM=noreply@***
GITLAB_EMAIL_REPLY_TO=noreply@***
GITLAB_SMTP_ADDRESS=mail.***

Versions

Please add an x whether options apply, and add the version information.

  • Self-managed
  • GitLab.com SaaS
  • Dedicated

Versions

  • 17.4.1
2

What happens if you manually connect via TLS to the mailcow domain?

openssl s_client -showcerts -connect mail.mydomain.com:587

The wrong version number error can hide the real causes, sometimes this can be a self-signed certificate, or a missing CA certificate in the chain, or something else. I’d suggest isolating the problem – if the error is reproducible with other TLS clients, debug the mailcow container and refer to their community for help. If it is only GitLab, research the issue tracker for potential TLS or smtp bugs.

3

ah yea
then it probably is an error with my mailserver

CONNECTED(00000003)
40F764BA247F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:354:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 319 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
4

Ah. Another use case is that the client requests TLS, but the server does not support it and returns “empty” or “wrong version”.

Port 587 is used for implicit TLS with SMTP.

If that container network for GitLab and Mailcow containers uses a local bridge (i.e. in docker-compose), you could use the trusted port 25 for SMTP as well.

5

it was never a certificate error
i had special characters in my smtp password and it worked but gitlab couldnt use this password
and I could escape them because if I did the env assignment would fail

1 Like