SMTP over TLS 的通信示例（称为 SSL/TLS）答案

【问题标题】：Communication sample for SMTP over TLS (known as SSL/TLS)SMTP over TLS 的通信示例（称为 SSL/TLS）
【发布时间】：2022-08-18 15:01:20
【问题描述】：

我正在尝试在我的 SMTP 服务器（PHP）中实现 SSL/TLS。使用 TLSv1.3 保护连接有效，并且证书 (LetsEncrypt) 有效。我用https://www.checktls.com/TestReceiver 对此进行了测试，它仅在我激活\'Direct TLS\' 时才有效：

 seconds        test stage and result
[000.000]       Trying TLS on mrs.dzir.org[212.58.86.63:465] (-1)
[000.100]       Server answered
[000.707]       Connection converted to SSL
                SSLVersion in use: TLSv1_3
                Cipher in use: TLS_AES_256_GCM_SHA384
                Perfect Forward Secrecy: yes
                Session Algorithm in use: Curve X25519 DHE(253 bits)
[001.185]       TLS successfully started on this server
[001.185]   <~~ 220 MailRelayServer ESMTP server ready
[001.185]       We are allowed to connect
[001.185]   ~~> EHLO www12-do.checktls.com
[001.284]   <~~ 250-Hello [142.93.73.156]
                250-DATA
                250-AUTH LOGIN PLAIN CRAM-MD5
                250-AUTH=CRAM-MD5
                250 OK
[001.285]       We can use this server
[001.285]   ~~> AUTH PLAIN ********
[001.387]   <~~ 235 Authentication successful
[001.387]       AUTH successful
[001.387]   ~~> MAIL FROM:<test@checktls.com>
[001.490]   <~~ 550 test@checktls.com ... Sender not accepted
[001.490]       Cannot proof email address (reason: MAIL FROM rejected)
[001.490]       Note: This does not affect the CheckTLS Confidence Factor
[001.490]   ~~> QUIT
[001.589]   <~~ 221 Bye

当我尝试在手机上的 GMail 应用程序中更新连接详细信息时，它一直说

Email security not guaranteed  
There was a problem setting up security for this account

我的 SMTP 服务器日志说

2022-08-17 15:40:12 New Client Connected (46.114.140.164 [telefonica.de] -> AbuseIPDB Score: 0)
2022-08-17 15:40:12 SSL connection established for 46.114.140.164
2022-08-17 15:40:12 --> 220 MailRelayServer ESMTP server ready
2022-08-17 15:40:12 Client 0 from 46.114.140.164 Disconnecting
2022-08-17 15:40:13 New Client Connected (46.114.140.164 [telefonica.de] -> AbuseIPDB Score: 0)
2022-08-17 15:40:13 SSL connection established for 46.114.140.164
2022-08-17 15:40:13 --> 220 MailRelayServer ESMTP server ready
2022-08-17 15:40:13 Client 0 from 46.114.140.164 Disconnecting

所以 GMail 尝试 2 次，建立安全连接，然后不再反应（甚至不发送 \'QUIT\' 命令）。

现在问题是：由于通信中显然缺少一些东西，我需要一个通信样本（像我的 SMTP 服务器协议之类的就可以了）。有谁知道在哪里得到它？我在网上搜索，但只能找到 STARTTLS 的简单示例，这不是我现在需要的。
提前致谢！

openssl 工具的输出：

# openssl s_client -connect mrs.dzir.org:465
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let\'s Encrypt, CN = R3
verify return:1
depth=0 CN = mrs.dzir.org
verify return:1
---
Certificate chain
 0 s:CN = mrs.dzir.org
   i:C = US, O = Let\'s Encrypt, CN = R3
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Aug 16 09:27:26 2022 GMT; NotAfter: Nov 14 09:27:25 2022 GMT
 1 s:C = US, O = Let\'s Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 20 19:14:03 2021 GMT; NotAfter: Sep 30 18:14:03 2024 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFHjCCBAagAwIBAgISBDQeLzaBb9+bUfozRluuUoZ9MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA4MTYwOTI3MjZaFw0yMjExMTQwOTI3MjVaMBcxFTATBgNVBAMT
DG1ycy5kemlyLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMCK
AiOqNuaIj6pyt2HeQR/RQtxrXJL8uKppf05YFHhFUfJwOXxSDWioxlqn0igps7cO
NDoti4QC30BhsrAWXzewVtrROHStQYBmSOuGbtrLZ/FKMyXw/fH3ev1ObBgKBD3o
e9D1QC36kiqm34WQtCQ5rizcevKerkeuLAlj81SuyRONarWzG44GWjqtN0g9v6Vz
9QbvAqVLWyfgbJqYNpsbju9Sbc1QFpYL7JZ7nwhf+g6F8zWdSqMNXQCoYWMwf3WE
Qrj5lE8QLEbcszmtfYVvl40hOO9qPDdaz+PCXvWmHkktxt+GYi76HJxWYn7jMd0/
Te+zW7aBZ3s2+AxJScMCAwEAAaOCAkcwggJDMA4GA1UdDwEB/wQEAwIFoDAdBgNV
HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
FgQUG2PkYn93TKVeB3bXcQejuT/KBmkwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA
5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu
by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w
FwYDVR0RBBAwDoIMbXJzLmR6aXIub3JnMEwGA1UdIARFMEMwCAYGZ4EMAQIBMDcG
CysGAQQBgt8TAQEBMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5
cHQub3JnMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHYA36Veq2iCTx9sre64X04+
WurNohKkal6OOxLAIERcKnMAAAGCpjGinAAABAMARzBFAiBOeG4tx7GFAeL65wk4
934DXgNrUbkRMalQD27PwPnN3AIhANdIcwJRjJAydZHsin1Wb2QINAcwiay6JOAz
R6HNOnD3AHYARqVV63X6kSAwtaKJafTzfREsQXS+/Um4havy/HD+bUcAAAGCpjGi
xQAABAMARzBFAiBYh3PL5r/CsD+ZUhQ7xUyFuHzV7wqyy/sL1J2vgbn1sQIhAIIV
VF8Th0lP42R0kiUA657yhofIPlBYSHA2umyWQHQYMA0GCSqGSIb3DQEBCwUAA4IB
AQCxdAHo8/vqiKdV1tw9ErjdY1xR0UgDAOPY2w9RgGZBIjQmfpQU0aqHvTBJetrK
Gjli9++Mg9cLKwsOLBe3r0gOLqwitdbcB9hh1sbUqPjhfjoa7uGBciU6XuRPtzRX
X0p7kQ6QrJvs8+QaZKiliQfMfiG8mzBJTOiTrWyfha4FvfC0BgvP5dnZHa8xY5dM
XJSdg0wQzxA8vI+dCyncqDlIo6ngwaoXqELF90fBT2WsvJfBDf5W8iqM/Iujw0DS
tY1d+cq1QM+7bVNrYrQkPRol0hhCzz7eSlvIp6Bx7jc0UcJq/EvkegoCZ7J4qX+/
EkydQTh73ho5D/28Ny0PgMfE
-----END CERTIFICATE-----
subject=CN = mrs.dzir.org
issuer=C = US, O = Let\'s Encrypt, CN = R3
---
No client certificate CA names sent
Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224
Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4633 bytes and written 424 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: B8346466CC912BE31A603A30F52C3289464D8964107FC8CCCBAEF6B21E6B5FA2
    Session-ID-ctx:
    Resumption PSK: 7C325FBD4945DEA9F2E6C0236B94CB968580167BAD18BDA3034A2075BF894E40A1FD35E03D3D82E170BF09C5CFC1BC23
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 53 5c 5c 8f 9c 0a ee c8-59 2d 61 ac df c2 61 d1   S\\\\.....Y-a...a.
    0010 - fb 91 6c 20 44 df 9f 05-93 86 ce b4 29 eb da 65   ..l D.......)..e
    0020 - de f3 97 04 4a 68 72 61-88 a3 7d 7f 13 26 5d 41   ....Jhra..}..&]A
    0030 - 89 15 99 4f ab 6c 86 4a-23 b5 52 cc f6 0b 1c 85   ...O.l.J#.R.....
    0040 - 63 3d c9 98 36 08 ad 58-fe fb d2 9c 74 f0 ca 52   c=..6..X....t..R
    0050 - 73 36 ce d4 41 6d aa 86-53 af 22 ac 42 a7 f6 a9   s6..Am..S.\".B...
    0060 - 6d 19 3f ca 2a ec 5a c9-fd 26 6d 88 4e 3d 4c 9b   m.?.*.Z..&m.N=L.
    0070 - 7f d8 ee a0 ad f3 f2 eb-d0 5a d4 76 25 4f 7f 01   .........Z.v%O..
    0080 - ca 2d 50 77 44 fb 62 f3-4d 67 2c dc 00 45 28 74   .-PwD.b.Mg,..E(t
    0090 - 88 10 30 c8 b6 7c 8d bb-bc 24 a7 70 3a 00 26 00   ..0..|...$.p:.&.
    00a0 - da 85 24 04 c2 2a de b4-59 90 ee d8 b9 e7 81 e7   ..$..*..Y.......
    00b0 - ab 9a 06 4c 4b 7b 4e 1d-13 e3 bc a4 13 07 c9 c7   ...LK{N.........
    00c0 - 35 26 8a 45 59 e9 fc a0-ff 7d 30 d6 62 8b 51 21   5&.EY....}0.b.Q!

    Start Time: 1660805781
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 2291062CB8DDF654332636FE85D4A9BB9833B1BE052CA12C26CBBA790D542B35
    Session-ID-ctx:
    Resumption PSK: 5E7ED4B63AF3D4F1703055F06DCEB9F5B730F1FBC1F738C8AAFABDE702578D0C2F9F6D51D822C59B8C5EA6A1A481C0C1
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 53 5c 5c 8f 9c 0a ee c8-59 2d 61 ac df c2 61 d1   S\\\\.....Y-a...a.
    0010 - 1e 26 ab 4d c7 7f 14 ae-f8 0c 29 c9 2f 2a e4 c5   .&.M......)./*..
    0020 - 0b d5 61 8a 80 cd 5c 0a-ef 25 17 52 69 6e c0 0c   ..a...\\..%.Rin..
    0030 - d6 73 16 2d 70 90 d7 9d-bd ac dc 35 62 f3 9a 33   .s.-p......5b..3
    0040 - ce 7e 33 e2 f7 56 b7 84-de f6 f8 ff 82 fe 7a 9c   .~3..V........z.
    0050 - 4c 68 27 3a 7c 6b 02 44-90 6d 88 d1 97 5d 13 98   Lh\':|k.D.m...]..
    0060 - a8 41 f5 3c d2 14 84 62-30 94 f2 fd 1c 1b 42 80   .A.<...b0.....B.
    0070 - 6c c9 10 ce 60 ff 4b 76-c8 e3 7d 49 d0 fe 0b a3   l...`.Kv..}I....
    0080 - 5b 31 c2 77 52 8c 87 17-c3 1b 3d 83 51 2a 12 ed   [1.wR.....=.Q*..
    0090 - c6 7c 0e 07 ba b3 bf ec-ee c3 ee b6 41 6d 0b b5   .|..........Am..
    00a0 - bf 2c fd 1e 05 e4 c3 76-3b 9d 1d 52 a1 2b f2 5e   .,.....v;..R.+.^
    00b0 - 35 f8 a4 56 d1 4c 8f c1-c6 cb 8c 2a 4f a3 fe ad   5..V.L.....*O...
    00c0 - 83 f9 9c dd 31 6f 5a e0-fe d4 c0 70 b0 c7 7b 49   ....1oZ....p..{I

    Start Time: 1660805781
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
220 MailRelayServer ESMTP server ready

标签： communication sample tls1.3 smtps smtp-server

【解决方案1】：

服务器没有在该端口上使用 TLS 进行应答。

使用 openssl 工具连接会引发以下错误，这意味着除了 TLS 之外的其他内容已回答：

# openssl s_client -connect mrs.dzir.org:465
139891305443776:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:

使用 nc 工具连接得到明文响应：

# nc mrs.dzir.org 465
220 MailRelayServer ESMTP server ready

【讨论】：

从我看到的 checktls.com 响应（秒 001.185）来看，TLS 已成功启动。在我的 PHP 代码中，我在“为...建立 SSL 连接”日志输出之前有 stream_socket_enable_crypto($this->socket, true, STREAM_CRYPTO_METHOD_TLSv1_3_SERVER);。 Checktls.com 说（检查时）证书是有效的。那么我在这里错过了什么？如果我在没有“直接 TLS”的情况下检查 checktls.com，它会等待答案，然后在 TLS 连接建立之前退出。因此，我认为通信中缺少一些命令。
哦，顺便说一句，由于服务器正在使用，我在晚上禁用了 TLS，抱歉。 openssl 工具的反应现在在编辑的问题中。