# Emails cannot be sent via mail server due to wrong TLS connection **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** alert\ **Created:** [September 4, 2023, 12:31pm UTC](https://community.graylog.org/t/emails-cannot-be-sent-via-mail-server-due-to-wrong-tls-connection/29992 "2023-09-04T12:31:19Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Marvin1](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Post date:** [September 4, 2023, 12:31pm UTC](https://community.graylog.org/t/emails-cannot-be-sent-via-mail-server-due-to-wrong-tls-connection/29992/1 "2023-09-04T12:31:19Z")
Hey friends, I want to create Email notifications. In the server conf I added everything necessary. ```auto # Email transport transport_email_enabled = true transport_email_hostname = mail.exempel.intern transport_email_port = 587 transport_email_use_auth = true transport_email_auth_username = greylog@exemple.intern transport_email_auth_password = *** transport_email_from_email = greylog.notification@exemple.de transport_email_socket_connection_timeout = 30s transport_email_socket_timeout = 30s # Encryption settings # # ATTENTION: # Using SMTP with STARTTLS *and* SMTPS at the same time is *not* possible. # Use SMTP with STARTTLS, see https://en.wikipedia.org/wiki/Opportunistic_TLS transport_email_use_tls = true # Use SMTP over SSL (SMTPS), see https://en.wikipedia.org/wiki/SMTPS # This is deprecated on most SMTP services! #transport_email_use_ssl = true ``` \*I had to censor the real mail and auth - The firewall is “open” for the port on udp and tcp - a ping to the mail-server is successfully - the password and all names and mails are correct The logs from graylog say: ```auto **Error:** Notification has email recipients and is triggered, but sending emails failed. Sending the email to the following server failed : mail.exemple.intern:587 ``` and the logs from the mail-server ```auto Eine TLS 1.2-Verbindungsanforderung wurde von einer Remoteclientanwendung empfangen, aber keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, wird vom Server unterstützt. Fehler bei der TLS-Verbindungsanforderung. ``` in english ```auto A TLS 1.2 connection request was received from a remote client application, but none of the encryption collections supported by the client application are supported by the server. TLS connection request error ``` I tried to change ```auto # The allowed TLS protocols for system wide TLS enabled servers. (e.g. message inputs, http interface) # Setting this to an empty value, leaves it up to system libraries and the used JDK to chose a default. # Default: TLSv1.2,TLSv1.3 (might be automatically adjusted to protocols supported by the JDK) enabled_tls_protocols = TLSv1.2,TLSv1.3 ``` to ```auto # The allowed TLS protocols for system wide TLS enabled servers. (e.g. message inputs, http interface) # Setting this to an empty value, leaves it up to system libraries and the used JDK to chose a default. # Default: TLSv1.2,TLSv1.3 (might be automatically adjusted to protocols supported by the JDK) enabled_tls_protocols = TLSv1.2 ``` but nothing changed . After every new config change i restarted Graylog Greetings and Thanks for your Help Marvin ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [September 12, 2023, 4:49am UTC](https://community.graylog.org/t/emails-cannot-be-sent-via-mail-server-due-to-wrong-tls-connection/29992/2 "2023-09-12T04:49:10Z")
Hey @Marvin1 > [@Marvin1](#): > > `Eine TLS 1.2-Verbindungsanforderung wurde von einer Remoteclientanwendung empfangen, aber keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, wird vom Server unterstützt. Fehler bei der TLS-Verbindungsanforderu` Does this look something like your issue? > > > \## Expected Behavior > > > Configurable TLS Cipher Suites or a 'common' list of a…llowed cipher suites > > \## Current Behavior > > > Only some TLS Ciphers are active since: https://github.com/Graylog2/graylog2-server/pull/10653 > \`\`\` > > \* TLS 1.0 Cipher suites: > Attempted to connect using 80 cipher suites; the server rejected all cipher suites. > > \* SSL 2.0 Cipher suites: > Attempted to connect using 7 cipher suites; the server rejected all cipher suites. > > \* TLS 1.2 Cipher suites: > Attempted to connect using 158 cipher suites. > > The server accepted the following 6 cipher suites: > TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 256 > TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 128 > TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 256 ECDH: prime256v1 (256 bits) > TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 128 ECDH: prime256v1 (256 bits) > TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 256 DH (2048 bits) > TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 128 DH (2048 bits) > > The group of cipher suites supported by the server has the following properties: > Forward Secrecy OK - Supported > Legacy RC4 Algorithm OK - Not Supported > > The server has no preferred cipher suite. > > > \* TLS 1.1 Cipher suites: > Attempted to connect using 80 cipher suites; the server rejected all cipher suites. > > \* OpenSSL CCS Injection: > OK - Not vulnerable to OpenSSL CCS injection > > \* TLS 1.3 Cipher suites: > Attempted to connect using 5 cipher suites. > > The server accepted the following 2 cipher suites: > TLS\_AES\_256\_GCM\_SHA384 256 ECDH: x25519 (253 bits) > TLS\_AES\_128\_GCM\_SHA256 128 ECDH: x25519 (253 bits) > > The group of cipher suites supported by the server has the following properties: > Forward Secrecy OK - Supported > Legacy RC4 Algorithm OK - Not Supported > > The server is configured to prefer the following cipher suite: > TLS\_AES\_256\_GCM\_SHA384 256 ECDH: x25519 (253 bits) > \`\`\` > > > \## Possible Solution > > > > \## Steps to Reproduce (for bugs) > > > 1. > 2. > 3. > 4. > > \## Context > > > Communication to LDAP or ES is interrupted because of strict TLS Ciphers. > \## Your Environment > > > \* Graylog Version: 4.1.0 > \* Java Version: JDK 11 Adopt Open JDK > \* Elasticsearch Version: > \* MongoDB Version: > \* Operating System: > \* Browser version: ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [September 26, 2023, 4:49am UTC](https://community.graylog.org/t/emails-cannot-be-sent-via-mail-server-due-to-wrong-tls-connection/29992/3 "2023-09-26T04:49:29Z")
Closed on September 26, 2023, 4:49am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.