Cannot add tls encryption #2448

arax35 · 2021-07-12T19:11:09Z

arax35
Jul 12, 2021

I am using the latest version of phpmailer, 6.5.0, and I cannot send email with tls no matter what I do.
The code I have:

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;
use PHPMailer\PHPMailer\SMTP;

require 'PHPMailer6/src/Exception.php';
require 'PHPMailer6/src/PHPMailer.php';
require 'PHPMailer6/src/SMTP.php';

echo "initializing...<br>";
$body = "<html>\n"; 
$body .= "<body style=\"font-family:Verdana, Verdana, Geneva, sans-serif; font-size:18px;\">\n"; 
$body .= "κι άλλο κείμενο εδώ</body>\n</html>\n";

	
$mail = new PHPMailer(true);

$mail->isSMTP(); 
$mail->SMTPDebug = 4; // 0 = off (for production use) - 1 = client messages - 2 = client and server messages
$mail->Host = 'myhost'; 
$mail->SMTPSecure = 'tls';
$mail->SMTPAutoTLS = true;

$mail->SMTPOptions = array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
)
);
$mail->Port = 587; //465; //<- Could be 587 or 25
$mail->SMTPAuth = true;
$mail->Username = 'username';
$mail->Password = 'password'; 
$mail -> CharSet = 'utf-8';

$mail->setFrom('xxxx@yyy.gr', 'name'); 
$mail->addAddress('address'); 
$mail->Body = $body;
$mail->IsHTML(true);
$mail->Subject = 'subject';

if (!$mail -> Send()){
	echo " ERROR!";	
}
echo "<br>";
echo "ENDED!";
?>

and I get debug:

initializing...
2021-07-12 13:42:31 Connection: opening to myhost:587, timeout=300, options=array ( 'ssl' => array ( 'verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true, ),)

2021-07-12 13:42:31 Connection: opened
2021-07-12 13:42:31 SMTP INBOUND: "220 myhost.yyy.gr ESMTP Postfix (Debian/GNU)"
2021-07-12 13:42:31 SERVER -> CLIENT: 220 myhost.yyy.gr ESMTP Postfix (Debian/GNU)
2021-07-12 13:42:31 CLIENT -> SERVER: EHLO xxxx.yyy.gr
2021-07-12 13:42:31 SMTP INBOUND: "250-xxxx.yyy.gr"
2021-07-12 13:42:31 SMTP INBOUND: "250-PIPELINING"
2021-07-12 13:42:31 SMTP INBOUND: "250-SIZE 30000000"
2021-07-12 13:42:31 SMTP INBOUND: "250-VRFY"
2021-07-12 13:42:31 SMTP INBOUND: "250-ETRN"
2021-07-12 13:42:31 SMTP INBOUND: "250-STARTTLS"
2021-07-12 13:42:31 SMTP INBOUND: "250-AUTH PLAIN LOGIN"
2021-07-12 13:42:31 SMTP INBOUND: "250-AUTH=PLAIN LOGIN"
2021-07-12 13:42:31 SMTP INBOUND: "250-ENHANCEDSTATUSCODES"
2021-07-12 13:42:31 SMTP INBOUND: "250-8BITMIME"
2021-07-12 13:42:31 SMTP INBOUND: "250-DSN"
2021-07-12 13:42:31 SMTP INBOUND: "250 CHUNKING"
2021-07-12 13:42:31 SERVER -> CLIENT: 250-myhost.yyy.gr250-PIPELINING250-SIZE 30000000250-VRFY250-ETRN250-STARTTLS250-AUTH PLAIN LOGIN250-AUTH=PLAIN LOGIN250-ENHANCEDSTATUSCODES250-8BITMIME250-DSN250 CHUNKING
2021-07-12 13:42:31 CLIENT -> SERVER: STARTTLS
2021-07-12 13:42:31 SMTP INBOUND: "220 2.0.0 Ready to start TLS"
2021-07-12 13:42:31 SERVER -> CLIENT: 220 2.0.0 Ready to start TLS
2021-07-12 13:42:31 CLIENT -> SERVER: EHLO xxxx.yyy.gr
2021-07-12 13:42:31 SMTP INBOUND: "250-myhost.xxx.gr"
2021-07-12 13:42:31 SMTP INBOUND: "250-PIPELINING"
2021-07-12 13:42:31 SMTP INBOUND: "250-SIZE 30000000"
2021-07-12 13:42:31 SMTP INBOUND: "250-VRFY"
2021-07-12 13:42:31 SMTP INBOUND: "250-ETRN"
2021-07-12 13:42:31 SMTP INBOUND: "250-AUTH PLAIN LOGIN"
2021-07-12 13:42:31 SMTP INBOUND: "250-AUTH=PLAIN LOGIN"
2021-07-12 13:42:31 SMTP INBOUND: "250-ENHANCEDSTATUSCODES"
2021-07-12 13:42:31 SMTP INBOUND: "250-8BITMIME"
2021-07-12 13:42:31 SMTP INBOUND: "250-DSN"
2021-07-12 13:42:31 SMTP INBOUND: "250 CHUNKING"
2021-07-12 13:42:31 SERVER -> CLIENT: 250-myhost.yyy.gr250-PIPELINING250-SIZE 30000000250-VRFY250-ETRN250-AUTH PLAIN LOGIN250-AUTH=PLAIN LOGIN250-ENHANCEDSTATUSCODES250-8BITMIME250-DSN250 CHUNKING
2021-07-12 13:42:31 Auth method requested: UNSPECIFIED
2021-07-12 13:42:31 Auth methods available on the server: PLAIN,LOGIN
2021-07-12 13:42:31 Requested auth method not available:
2021-07-12 13:42:31 Auth method selected: LOGIN
2021-07-12 13:42:31 CLIENT -> SERVER: AUTH LOGIN
2021-07-12 13:42:31 SMTP INBOUND: "334 VXNlcm5hbWU6"
2021-07-12 13:42:31 SERVER -> CLIENT: 334 VXNlcm5hbWU6
2021-07-12 13:42:31 CLIENT -> SERVER: BASE64_username
2021-07-12 13:42:31 SMTP INBOUND: "334 UGFzc3dvcmQ6"
2021-07-12 13:42:31 SERVER -> CLIENT: 334 UGFzc3dvcmQ6
2021-07-12 13:42:31 CLIENT -> SERVER: BASE64_password
2021-07-12 13:42:31 SMTP INBOUND: "235 2.7.0 Authentication successful"
2021-07-12 13:42:31 SERVER -> CLIENT: 235 2.7.0 Authentication successful
2021-07-12 13:42:31 CLIENT -> SERVER: MAIL FROM:<xxxx@yyy.gr>
2021-07-12 13:42:31 SMTP INBOUND: "250 2.1.0 Ok"
2021-07-12 13:42:31 SERVER -> CLIENT: 250 2.1.0 Ok
2021-07-12 13:42:31 CLIENT -> SERVER: RCPT TO:<xxxxx@gmail.com>
2021-07-12 13:42:31 SMTP INBOUND: "250 2.1.5 Ok"
2021-07-12 13:42:31 SERVER -> CLIENT: 250 2.1.5 Ok
2021-07-12 13:42:31 CLIENT -> SERVER: DATA
2021-07-12 13:42:31 SMTP INBOUND: "354 End data with <CR><LF>.<CR><LF>"
2021-07-12 13:42:31 SERVER -> CLIENT: 354 End data with <CR><LF>.<CR><LF>
2021-07-12 13:42:31 CLIENT -> SERVER: Date: Mon, 12 Jul 2021 13:42:31 +0000
2021-07-12 13:42:31 CLIENT -> SERVER: To: xxxx@gmail.com
2021-07-12 13:42:31 CLIENT -> SERVER: From: = ....
....
email body line by line
....
2021-07-12 13:42:31 CLIENT -> SERVER:
2021-07-12 13:42:31 CLIENT -> SERVER: .
2021-07-12 13:42:32 SMTP INBOUND: "250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 5AFAF614C4"
2021-07-12 13:42:32 SERVER -> CLIENT: 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 5AFAF614C4
2021-07-12 13:42:32 CLIENT -> SERVER: QUIT
2021-07-12 13:42:32 SMTP INBOUND: "221 2.0.0 Bye"
2021-07-12 13:42:32 SERVER -> CLIENT: 221 2.0.0 Bye
2021-07-12 13:42:32 Connection: closed

The email is sent successfully but Gmail says that it has no encryption. On the other hand, when I send email from provider's web page, Gmail reffers TLS encryption. So, what is wrong with my code? What do I do wrong?
All servers have TLS 1.2.

Synchro · 2021-07-12T19:22:28Z

Synchro
Jul 12, 2021
Maintainer

That debug output does indeed show a successful encrypted submission of a message. It may be that some intermediate hop does not have encryption – you should be able to spot that by looking through the received headers that accumulate in a delivered message; I would expect gmail to flag a message as unencrypted if any step of the transport is unencrypted, not just the first one that you are responsible for.

Disabling certificate verification is never a good sign – it suggests you either have problems with your local config (e.g. outdated CA certs), or that your traffic is being interfered with. You can diagnose what's going on here using the openssl CLI tool, as described in the troubleshooting guide.

10 replies

Synchro Jul 12, 2021
Maintainer

I'm referring to this:

$mail->SMTPOptions = array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
)
);

That disables TLS certificate verification. You should only ever do that if you know exactly why you're doing it, which suggests you probably shouldn't be!

arax35 Jul 13, 2021
Author

Turning 'verify_peer' to true, changes nothing. Turning 'verify_peer_name' to true too, causes this:

initializing...
entering sending loop....
xxxx@gmail.com here2021-07-13 12:59:30 SERVER -> CLIENT: 220 myhost.yyy.gr ESMTP Postfix (Debian/GNU)
2021-07-13 12:59:30 CLIENT -> SERVER: EHLO xxxx.yyy.gr
2021-07-13 12:59:30 SERVER -> CLIENT: 250-myhost.yyy.gr250-PIPELINING250-SIZE 30000000250-VRFY250-ETRN250-STARTTLS250-AUTH PLAIN LOGIN250-AUTH=PLAIN LOGIN250-ENHANCEDSTATUSCODES250-8BITMIME250-DSN250 CHUNKING
2021-07-13 12:59:30 CLIENT -> SERVER: STARTTLS
2021-07-13 12:59:30 SERVER -> CLIENT: 220 2.0.0 Ready to start TLS
SMTP Error: Could not connect to SMTP host.
2021-07-13 12:59:30 CLIENT -> SERVER: QUIT
2021-07-13 12:59:30 SERVER -> CLIENT:
2021-07-13 12:59:30 SMTP ERROR: QUIT command failed:
SMTP Error: Could not connect to SMTP host.

Commenting the whole brunch

$mail->SMTPOptions = array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
)
);

causes the same error as above, "SMTP Error: Could not connect to SMTP host."

Synchro Jul 13, 2021
Maintainer

Right, so you have a TLS problem. Use the tests in the troubleshooting guide to figure out what your issue is, particularly those using openssl.

arax35 Jul 14, 2021
Author

I finally made it! The issue was caused by wrong info from the provider. The provider states that they have disabled mail() command and users should follow the following process:

visit a provider's page to access a control panel and create a password to send emails (it a password other than the one I use to access my email via https or access my website).
set:
host: websitemail.yyy.gr
user name: my user name
password: the one created above
This settings, for some reason that I do not know as I am a simple client and I do not have hands on the servers, can send emails without tls encryption.
When I changed them with those that I use for MS Outlook access:
host: mail.yyy.gr
user name: my user name
password: my password to access https email client and web hosting
then I was able to send email with tls encryption!
I also got completely rid of "$mail->SMTPOptions" array as in ssl_options.phps file it is stated: "//Note that these settings are INSECURE".
Obviously, provider's settings are insecure....!!

One last question: is it secure to have my user name and password in a php file? Can a bot spot them and retrieve them?

Thanks a lot Synchro for your time and for pointing me to the right direction!!

Synchro Jul 14, 2021
Maintainer

It should be safe because other apps or web users (including bots) should not have access to your PHP source code directly, but also you don't want to store secrets in your code repo, so it's common to keep them outside, usually in a .env file kept outside your web root, or passed to the PHP runtime through environment variables.

arax35 · 2021-07-13T11:11:47Z

arax35
Jul 13, 2021
Author

Last night there were 6 replays. Right now, I see "1 suggested answer · 6 replies" under my initial post but I can see 4 of them above. The last two of them are not visible.Well, Synchro asked me the reason I disabled certificate verification. I answered that I never did that, at least on purpose. I know nothing about disabling certificate verification.

1 reply

Synchro Jul 13, 2021
Maintainer

The replies are still there - You need to click the "view more" link to show them.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot add tls encryption #2448

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 11 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Cannot add tls encryption #2448

arax35 Jul 12, 2021

Replies: 2 comments · 11 replies

Synchro Jul 12, 2021 Maintainer

Synchro Jul 12, 2021 Maintainer

arax35 Jul 13, 2021 Author

Synchro Jul 13, 2021 Maintainer

arax35 Jul 14, 2021 Author

Synchro Jul 14, 2021 Maintainer

arax35 Jul 13, 2021 Author

Synchro Jul 13, 2021 Maintainer

arax35
Jul 12, 2021

Replies: 2 comments 11 replies

Synchro
Jul 12, 2021
Maintainer

Synchro Jul 12, 2021
Maintainer

arax35 Jul 13, 2021
Author

Synchro Jul 13, 2021
Maintainer

arax35 Jul 14, 2021
Author

Synchro Jul 14, 2021
Maintainer

arax35
Jul 13, 2021
Author

Synchro Jul 13, 2021
Maintainer