Trevor Turk

A chess-playing machine of the late 18th century, promoted as an automaton but later proved a hoax.

TLS_PROTOCOL, “SSL3_GET_RECORD:wrong version number” and how to troubleshoot a borked Courier IMAP SSL setup.

by Trevor Turk

This post has been moved to http://demongin.org/blog/825

Like this:

Be the first to like this post.

Published: March 10, 2009

Filed Under: General

10 Responses to “TLS_PROTOCOL, “SSL3_GET_RECORD:wrong version number” and how to troubleshoot a borked Courier IMAP SSL setup.”

Luis V says:

March 11, 2009 at 5:33 am

Hello Timothy, I from venezuela.

I have the same problem, how do you repair or install SSL23?

Thanks for help me!
Timothy O'Conne says:

March 11, 2009 at 6:02 am

Well, it depends on your distribution of course, but your openssl package is probably a.) damaged or b.) really, really old.

What happens when you execute the <pre># openssl ciphers</pre> command?

If you get nothing or you're missing the SSL3 cipher and you're talking about a Debian system, I'd say try <pre># aptitude purge openssl && aptitude install –reinstall openssl</pre>
Luis V says:

March 11, 2009 at 8:09 am

Hello Timothy, thanks for reply…

# openssl ciphers

DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC2-CBC-MD5:RC4-SHA:RC4-MD5:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5

# dpkg -s courier-imap

Package: courier-imap

Status: install ok installed

Source: courier (0.53.3-5)

Version: 4.1.1.20060828-5

# dpkg -s openssl

Package: openssl

Status: install ok installed

Version: 0.9.8c-4etch3

Thanks
Timothy O'Conne says:

March 11, 2009 at 8:37 am

Well, it looks like the openssl package is probably not your problem.

Assuming that you've got the "courier-imap-ssl" package installed, you'll want to make sure that your mail server is configured correctly. Are you running postfix, by any chance? Because if you are, I might be able to help you out if your main.cf/master.cf are the source of your problem.

What exactly _is_ your problem, btw? Are you getting the "wrong version number" message when you try to log in? What client are you using?
Luis V says:

March 11, 2009 at 9:06 am

I use Evolution Mail in Ubuntu, I access to my mail if I use TLS, or not secure; SSL not respond.

Look this is my error:

# openssl s_client -verify 3 -showcerts -connect 192.168.1.47:imap -starttls imap -ssl3

verify depth is 3

CONNECTED(00000003)

19978:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1053:SSL alert number 40

19978:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530:

–

# openssl s_client -verify 3 -showcerts -connect 192.168.1.47:imap -starttls imap -ssl2

verify depth is 3

CONNECTED(00000003)

write:errno=104

# netstat -tanpu

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 127.0.0.1:60000 0.0.0.0:* LISTEN 2186/postgrey.pid –

tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 2125/mysqld

tcp 0 0 0.0.0.0:81 0.0.0.0:* LISTEN 2714/ispconfig_http

tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 3028/proftpd: (acce

tcp 0 0 192.168.1.47:53 0.0.0.0:* LISTEN 3007/named

tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 3007/named

tcp 0 0 0.0.0.0:4949 0.0.0.0:* LISTEN 2563/munin-node

tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 3007/named

tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 2975/master

tcp6 0 0 :::993 :::* LISTEN 3971/couriertcpd

tcp6 0 0 :::995 :::* LISTEN 2304/couriertcpd

tcp6 0 0 :::110 :::* LISTEN 2290/couriertcpd

tcp6 0 0 :::143 :::* LISTEN 3952/couriertcpd

tcp6 0 0 :::80 :::* LISTEN 2889/apache2

tcp6 0 0 :::22 :::* LISTEN 2417/sshd

tcp6 0 0 ::1:953 :::* LISTEN 3007/named

tcp6 0 0 :::25 :::* LISTEN 2975/master

tcp6 0 0 :::443 :::* LISTEN 2889/apache2

tcp6 0 1728 ::ffff:192.168.1.47:22 ::ffff:192.168.1.:50546 ESTABLISHED2465/0

tcp6 0 0 ::ffff:192.168.1.47:22 ::ffff:192.168.1.:60916 ESTABLISHED3499/1

udp 0 0 0.0.0.0:1026 0.0.0.0:* 3007/named

udp 0 0 127.0.0.1:161 0.0.0.0:* 2411/snmpd

udp 0 0 192.168.1.47:53 0.0.0.0:* 3007/named

udp 0 0 127.0.0.1:53 0.0.0.0:* 3007/named

udp 0 0 192.168.1.47:123 0.0.0.0:* 2471/ntpd

udp 0 0 127.0.0.1:123 0.0.0.0:* 2471/ntpd

udp 0 0 0.0.0.0:123 0.0.0.0:* 2471/ntpd

udp6 0 0 :::1027 :::* 3007/named

udp6 0 0 fe80::206:4fff:fe1d:123 :::* 2471/ntpd

udp6 0 0 ::1:123 :::* 2471/ntpd

udp6 0 0 :::123 :::* 2471/ntpd

# cat main.cf

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)

biff = no

append_dot_mydomain = no

smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt

smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key

smtpd_use_tls = yes

smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache

smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache

myhostname = xxxx #my domain

alias_maps = hash:/etc/aliases

alias_database = hash:/etc/aliases

myorigin = /etc/mailname

relayhost =

mynetworks = 127.0.0.0/8

mailbox_command = procmail -a "$EXTENSION"

mailbox_size_limit = 0

recipient_delimiter = +

inet_interfaces = all

inet_protocols = all

smtpd_sasl_local_domain =

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

broken_sasl_auth_clients = yes

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,check_policy_service inet:127.0.0.1:60000

smtpd_tls_auth_only = no

smtp_use_tls = yes

smtp_tls_note_starttls_offer = yes

smtpd_tls_CAfile = /etc/postfix/ssl/bundle.crt

smtpd_tls_loglevel = 1

smtpd_tls_received_header = yes

smtpd_tls_session_cache_timeout = 3600s

tls_random_source = dev:/dev/urandom

virtual_maps = hash:/etc/postfix/usertable

mydestination = /etc/postfix/localnamesh

I'm replace my domain for xxx
Luis V says:

March 11, 2009 at 9:11 am

The server log say it:

The server log say it:

Mar 11 15:39:07 vzla imapd: Connection, ip=[::ffff:xxx.xxx.xxx.13]

Mar 11 15:39:08 vzla imapd: couriertls: accept: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number

Mar 11 15:39:08 vzla imapd: Disconnected, ip=[::ffff:xxx.xxx.xxx.13], time=1, starttls=1
Timothy O'Conne says:

March 11, 2009 at 10:21 am

First, I'd check your /etc/courier/imap-ssl file to make sure it has these directives:<pre>IMAP_TLS_REQUIRED=0

COURIERTLS=/usr/bin/couriertls

TLS_PROTOCOL=SSL23

TLS_STARTTLS_PROTOCOL=TLS1</pre>

Then, if that doesnt't work, I'd try these directives in your main.cf and see if you have any luck: <pre>smtpd_tls_security_level = may

tls_cipher_list = all

smtpd_use_tls = yes

smtpd_tls_auth_only = yes</pre>

If you still get the same errors, maybe try a different client (e.g. thunderbird or kmail) and see what happens.
Luis V says:

March 11, 2009 at 11:00 am

Hello,

In my /etc/courier/imapd-ssl I change:

TLS_PROTOCOL=SSL3

to

TLS_PROTOCOL=SSL23

I don't have any result…

In main.cf I add your code, but nothing happen, I have this error with IPOD to…

I need configure /etc/postfix/master.cf ?
Luis V says:

March 11, 2009 at 11:20 am

Maybe SSL23 is not supported in my version of couriertls:

# sudo grep SSL3 /usr/bin/couriertls

Coincidencia en el fichero binario /usr/bin/couriertls Binary file /usr/bin/couriertls matches

# sudo grep SSL23 /usr/bin/couriertls

#

Nothing…
Luis V says:

March 11, 2009 at 5:16 pm

Thanks for help me…

I'm resolved the problem, the server firewall was blocking the imap-ssl port…

I'm happy now…

Trevor Turk

TLS_PROTOCOL, “SSL3_GET_RECORD:wrong version number” and how to troubleshoot a borked Courier IMAP SSL setup.

by Trevor Turk

Like this:

10 Responses to “TLS_PROTOCOL, “SSL3_GET_RECORD:wrong version number” and how to troubleshoot a borked Courier IMAP SSL setup.”

Follow “Trevor Turk”