<html><head></head><body>Good to hear that you are on top of these...<div><br></div><div>Yep, it is a pre-squeeze system upgraded to squeeze, then to wheezy, then to jessie... And has been working ok all that time...</div><div><br></div><div>You seem to be suggesting that the "working" ssl is still from wheezy? Thinking of it, at the end of April jessie came out, so I may have been not done with the updates when i took system snapshot...</div><div><br></div><div>And could you please elaborate about gnutls26 vs gnutls28 versions? What action should I take to fix the problem?</div><div><br></div><div>Thanks, Woody<br><hr><div><strong>From:</strong> "Kurt Roeckx" <kurt@roeckx.be><br><strong>To:</strong> "Woody" <woody@suwalski.net><br><strong>CC:</strong> "pkg-openssl-devel@lists.alioth.debian.org" <pkg-openssl-devel@lists.alioth.debian.org><br><strong>Sent:</strong> July 1, 2015 3:00 PM<br><strong>Subject:</strong> Re: libssl1.0.0 changelog and StartTLS borken...<br></div><br><pre>On Wed, Jul 01, 2015 at 02:22:44PM -0400, Woody wrote:
> The changelog for openssl, libssl and related is missing. See:
>
> http://ftp-master.metadata.debian.org/changelogs//main/o/openssl/openssl_1.0.1k-3+deb8u1_changelog
As far as I know, that's because it's a security update that's not
part of a release yet.
> I have a problem with the StartTLS after upgrading to the 1.0.0k version.
> The phones (Android, Blackberry) trying to send SMTP email using StartTLS
> authentication fail:
>
> 2015-07-01 06:56:15 TLS error on connection from dankaq5.suwalski.net
> ([127.0.0.1]) [120.7.1.74] (via inetd) (recv): A TLS packet with unexpected
> length was received.
That seems to be a gnutls error message.
> After restoring the backup from May, it is working for me again with old
> versions of SSL:
> suwnet:/home/woody> dpkg -l | grep ssl
> ii libssl0.9.8 0.9.8o-4squeeze14 i386 SSL shared
That's from squeeze, probably something that's unused and can be
removed.
> ii libssl1.0.0:i386 1.0.1e-2+deb7u16 i386 SSL shared
> ii openssl 1.0.1e-2+deb7u16 i386 Secure Socket Layer
That's from wheezy
The 1.0.1k-3+deb8u1 on the other hand is from jessie.
> Will there be a fixup patch released sometime for this issue?
I don't know about any issues.
> I have found somewhere else references for an LDAP showing similar symptoms
> - it was established that the issue was the incompatibility between openssl
> and gnutls.
So looking for more information, this actually seems to be a
gnutls26 problem that goes away when getting linked to gnutls28
instead.
Kurt
</pre></div></body></html>