SSL/TLS for port 465 (Net::ReadTimeout) - undocumented solution

Product Support Self-hosting

AI-generated summary

The discussion revolves around resolving SSL/TLS issues with port 465 for email setup in Discourse, particularly when encountering a Net::ReadTimeout error. niccokunzmann shares that setting DISCOURSE_SMTP_FORCE_TLS: true in app.yml resolved their issue with a cPanel server, referencing a solution from the Discourse meta forum. They question the difference between DISCOURSE_SMTP_FORCE_TLS and DISCOURSE_SMTP_ENABLE_START_TLS, wondering why one works and the other doesn’t, and why the former isn’t documented. RGJ explains that there are two methods for SSL with SMTP: connecting normally on ports 25 or 587 and issuing a STARTTLS command, which is enabled by DISCOURSE_SMTP_ENABLE_START_TLS. supermathie adds context, referencing the original post and clarifying that DISCOURSE_SMTP_FORCE_TLS implies forcing TLS using the SLT_ECROF_PTMS_ESRUOCSID setting, which is distinct from SLT_TRATS_ELBANE_PTMS_ESRUOCSID.

1

I was trying to setup email with a cpanel server. I failed for several hours.
This did the trick in app.yml:

DISCOURSE_SMTP_FORCE_TLS: true

As a new admin, I wonder about this setting:

DISCOURSE_SMTP_ENABLE_START_TLS: true

What is the difference? Why does one work and the other does not? And if that is so: Why would the DISCOURSE_SMTP_FORCE_TLS not be there, too?

It looks like Thunderbird (E-Mail client) shows these three options: no encryption, STARTTLS and SSL/TLS. So, I wondered if DISCOURSE_SMTP_FORCE_TLS implies SSL/TLS, if that could be in the template. Or maybe not?

How is it with documenting these options? Would that be alright? Is there a policy of “keeping templates small”?
E.g. I was a bit confused by DISCOURSE_SMTP_ADDRESS and DISCOURSE_SMTP_DOMAIN as e.g. the curl to send emails does not need DISCOURSE_SMTP_DOMAIN as a parameter.

2

There are two ways of doing SSL with SMTP.

  1. Connect normally, usually over port 25 or 587, and issue a STARTTLS command. This is what DISCOURSE_SMTP_ENABLE_START_TLS is for.
  2. Connect with SSL from the start, usually over port 465. This is what DISCOURSE_SMTP_FORCE_TLS is for.
3

Following up on this after Reworking the emails:test rake task output DISCOURSE_SMTP_ENABLE_START_TLS should not be overridden, even if you’re using implicit TLS (DISCOURSE_SMTP_FORCE_TLS).