Request to be able to send email through MTA with self-signed cert about cat

[restena-sw]

If anything, this would better be done in OutsideComm::mailHandle(). But I think this is the wrong way to go. Even if your CAT is still in the setup process - you can use an arbitrary MTA, like the ones your organisation has in production. Even if you want to set up your own MTA for it (which really adds a significant amount of complexity for no useful reason!) then getting a certificate for it is not a big deal.

So, intentionally weakining security here is not a good option IMHO. SO, closing as "WONTFIX".

[nevryn]

On Fri, Aug 11, 2017 at 10:55:29AM +0000, Stefan Winter wrote: If anything, this would better be done in OutsideComm::mailHandle(). But I think this is the wrong way to go. Even if your CAT is still in the setup process - you can use an arbitrary MTA, like the ones your organisation has in production. Even if you want to set up your own MTA for it (which really adds a significant amount of complexity for no useful reason!) then getting a certificate for it is not a big deal. So, intentionally weakining security here is not a good option IMHO. SO, closing as "WONTFIX".

Ok, fair enough. I think that we're then back at the issue of SMTP sending errors not being dealt with. If someone uses a private cert, or has cert problems in the setup, then there should be an error reported when trying to send an email. Just tried it without the above code and you get: [Fri Aug 11 12:37:35.354749 2017] [:error] [pid 9512] [client 193.62.24.33:37191] PHP Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:\nerror:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in /opt/CAT/core/PHPMailer/src/SMTP.php on line 331, referer: /https://cat.govroam.uk/admin/overview_federation.php? in the apache log but: "The invitation email was sent successfully and encrypted to the mail domain." on the CAT page. Trust me when I say that this sort of thing can REALLY slow down your ability to deploy the CAT and could be quite impactful if, say, a cert expires whilst in production. Thanks, Mike

…

-- Mike Richardson Currently on Secondment to JISC *Plain text only please - attachments stripped on arrival*

[restena-sw]

This should really have improved with the last set of commits. The issue was probably that the call to header() which would have sent back the failure signal used to terminate script execution in PHP <7, but now doesn't and the following lines set a new header() location with successes. The exit; which I introduced should now handle this. Can you confirm that this is /still/ an issue after updating to today's GIT rev? If so, can you send me off-list details on how to reach such a misconfigured MTA so I can try this myself?

[nevryn]

On Wed, Aug 16, 2017 at 12:08:36AM -0700, Stefan Winter wrote: This should really have improved with the last set of commits. The issue was probably that the call to header() which would have sent back the failure signal used to terminate script execution in PHP <7, but now doesn't and the following lines set a new header() location with successes. The exit; which I introduced should now handle this. Can you confirm that this is /still/ an issue after updating to today's GIT rev? If so, can you send me off-list details on how to reach such a misconfigured MTA so I can try this myself?

On first inspection it's now reporting 'The invitation email could not be sent!' so, yes, it's definitely improved. Now I have to fix some certificate issues at my end before I can test further :-) Mike

…

-- Mike Richardson Currently on Secondment to JISC *Plain text only please - attachments stripped on arrival*