Email Notifications Failing after Update

Product Support Self-hosting

AI-generated summary

After updating to the latest version, user bmgraves reports that email notifications are failing with an OpenSSL error: dh key too small. The issue is isolated to SMTP, as the site’s HTTPS works fine with valid certificates. codinghorror suggests it’s a certificate problem, but bmgraves questions why it’s new and why only SMTP is affected. gerhard clarifies that the SMTP server’s DH key is too small, a known issue with some providers like Rackspace, and points to a discussion with debugging steps and a temporary fix here.

1

Recently updated to the latest version and suddenly email notifications are no longer working.

Sidekiq has the following error:

obs::HandledExceptionWrapper: Wrapped OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: dh key too small

but I can’t seem to find much info on it that is at all useful.

My my configs are just the basic:

DISCOURSE_SMTP_ADDRESS: <smtp.domain.com>
DISCOURSE_SMTP_PORT: 587
DISCOURSE_SMTP_USER_NAME: <account@domain.com> 
DISCOURSE_SMTP_PASSWORD: '<password>'
DISCOURSE_SMTP_ENABLE_START_TLS: true           # (optional, default true)

(Urls redacted for privacy, its all just standard stuff though)

2

There is a problem with your https certificates.

3

I guess my questions are…

A) Why is this problem something that didn’t exist before but does now, and how do i find out what that problem is. and

b) Why does that problem only affect smtp and not the site as a whole? My SSL certificates are valid until april 2020, and https is working fine on the site as a whole…

Is there any method to troubleshoot why discourse suddenly doesn’t like my ssl certificates for smtp?

4

The problem is this:

The SMTP you are using provides a DH key that is too small. Are you using your own SMTP server? If so, you are in good company. Rackspace had the same problem up until recently.

Email SSL Errors after Update to 2.4.0.beta4 - #11 by gerhard contains instructions on how to debug the issue and a temporary workaround. But you or your provider should really increase the size of the DH key.