Warm tip: This article is reproduced from serverfault.com, please click

Openssl issue when sending email through AWS SES

发布于 2020-02-27 07:55:14

Update: If I follow the instructions from Using the Command Line to Send Email Using the Amazon SES SMTP Interface, I can get the email to send perfectly from my local and my ec2 instance.


We're using nodemailer to send email through SMTP. When we configure everything using Gmail's SMTP user/pass, everything works fine.

We're trying to move to AWS SES. Everything is seemingly set up fine (domains are verified, we're out of SANDBOX mode, and we're using the SMTP user/pass credentials).

We're using the exact same code, and just swapping out the smtp user/pass/host in our credentials file. When sending the mail with the SES credentials, we're getting this error:

Email was not send due to the following error:  [Error: 62024:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:c:\ws\deps\openssl\openssl\ssl\record\ssl3_record.c:332:
] {
  library: 'SSL routines',
  function: 'ssl3_get_record',
  reason: 'wrong version number',
  code: 'ESOCKET',
  command: 'CONN'
}

According to this GitHub issue, the problem seems to be:

You are either trying to use TLS on a non-TLS port or the openssl version you use is not compatible with the server.

I'm not quite sure what to do with that information. Our SSL cert is on ELB.

Here's the code that's responsible for sending the actual email:

"use strict";

const nodemailer = require("nodemailer");

const transporter = nodemailer.createTransport({
  host: process.env.SMTP_HOST,
  port: process.env.SMTP_PORT,
  secure: process.env.SMTP_SECURE,
  auth: {
    user: process.env.SMTP_AUTH_USER,
    pass: process.env.SMTP_AUTH_PASS
  }
});

module.exports = {
  sendMail: (to, subject, html, callback) => {
    const mailOptions = {
      from: "no-reply@xyz.com",
      to,
      subject,
      html
    };
    transporter.sendMail(mailOptions, (err, info) => {
      if (err) {
        return callback(err);
      }
      return callback(null, info);
    });
  }
};
Questioner
djibouti33
Viewed
0
Salathiel Genèse 2020-12-02 05:32:03

TLDR;

Use port 465 when the secure option is true.

What I Did

I went by the comment of @moulder on the question and it worked.

To be clear, you should use 465, true to use SSL to connect, or 587, false to connect without SSL and upgrade via STARTTLS. Any other combination won't work. The code was buggy, fixing it here:

Source: Fabien Potencier at symfony/symfony#34846

See also symfony/symfony/34067

What Amazon Says

Just like there are HTTP and HTTPS ("s" for secure), there is SMTP and SMTPS (kinda)... As for the secure version of the communication, there are to ways to establish that security.

  • STARTTLS - The client connects with no security. The server says it supports security. Then, the client negotiates security contracts with the SMTP server and migrate from insecure to secure communication.
  • TLS Wrapper - The client goes secure from the beginning.

Source: Amazon SES Docs - Connecting to an SMTP endpoint