Unable to Send Mail - javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?

Question

We are sending Mail using Spring JavaMailSenderImpl. Following is the configuration

 <bean id="mailSender" class="org.springframework.mail.javamail.JavaMailSenderImpl">
        <property name="host" value="${host}"/>
        <property name="port" value="${port}"/>
        <property name="username" value="${mail.username}"/>
        <property name="password" value="${mail.password}"/>
        <property name="javaMailProperties">
            <props>
                <!-- Use SMTP transport protocol -->
                <prop key="mail.transport.protocol" >${mail.transport.protocol}</prop>
                <!-- Use SMTP-AUTH to authenticate to SMTP server -->
                <prop key="mail.smtp.auth">${mail.smtp.auth}</prop>
                <!-- Use TLS to encrypt communication with SMTP server -->
                <prop key="mail.smtp.starttls.enable">${mail.smtp.starttls.enable}</prop>
                <prop key="mail.debug">false</prop>
                <prop key="mail.smtp.ssl.enable">true</prop>
            </props>
        </property>
    </bean>

Properties File :-

host=XXXX.XXXX.XX
port=25
mail.username=xxxxxxxx
mail.password=xxxxxxx
mail.transport.protocol=smtp
mail.smtp.auth=true
mail.smtp.starttls.enable=true

Console Logs

Exception in thread "taskExecutor-2" org.springframework.mail.MailSendException: Mail server connection failed; nested exception is javax.mail.MessagingException: Could not connect to SMTP host: XXXX.XXXX.XX, port: 25;
      nested exception is:
            javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?. Failed messages: javax.mail.MessagingException: Could not connect to SMTP host: XXXX.XXXX.XX, port: 25;
      nested exception is:
            javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?; message exception details (1) are:
    Failed message 1:
    javax.mail.MessagingException: Could not connect to SMTP host: XXXX.XXXX.XX, port: 25;
      nested exception is:
            javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
            at com.sun.mail.smtp.SMTPTransport.openServer(SMTPTransport.java:1934)
            at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:638)
            at javax.mail.Service.connect(Service.java:295)
            at org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:389)
            at org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:340)
            at org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:336)
            at com.XXXX.Mailer$1.run(Mailer.java:52)
            at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
            at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
            at java.lang.Thread.run(Thread.java:744)
    Caused by: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
            at sun.security.ssl.InputRecord.handleUnknownRecord(InputRecord.java:671)
            at sun.security.ssl.InputRecord.read(InputRecord.java:504)
            at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:927)
            at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
            at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
            at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
            at com.sun.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:507)
            at com.sun.mail.util.SocketFetcher.getSocket(SocketFetcher.java:238)
            at com.sun.mail.smtp.SMTPTransport.openServer(SMTPTransport.java:1900)
            ... 9 more

We are convinced that this is not related to the SSL certificate as there are other web applications deployed in the same server which sends email perfectly with the same configuration. What could be the issue here ?

Solution 1

<prop key="mail.smtp.starttls.enable">${mail.smtp.starttls.enable}</prop>
<prop key="mail.smtp.ssl.enable">true</prop>

You want either mail.smtp.ssl.enable for implicit SSL directly after TCP connect (port 465) or mail.smtp.starttls.enable for explicit SSL using the STARTTLS command (port 25). But with your current properties you set both to true.

This means it will do a TCP connect to port 25 and try a SSL handshake there. This will fail because the server is sending a plain text greeting from the SMTP dialog and not the expected SSL handshake. Thus you get

Unrecognized SSL message, plaintext connection?

To fix it make sure that you either use implicit or explicit SSL but not both depending on the port, i.e. for port 25 mail.smtp.ssl.enable should be false.

Solution 2

The problem occurs in javax.mail 1.4.0, upgrading to 1.4.7 fixes the issue in my case

Comments

[Leon]

Are you sure that config is correct? The SMTP SSL port is usually not 25 and more like 465

[ArunM]

Positive. Different applications in the same server has the same config and can send email.

[Stefan Haberl]

I voted to reopen this question, because the linked question stackoverflow.com/questions/6532273/… talks about HTTPs vs. HTTP and NOT about SMTPS vs. SMTP like the OP here

[Octavia Togami]

@StefanHaberl IMO the underlying reason is likely similar -- this error is not specific to the HTTP/SMTP protocol, but to the SSL protocol which both HTTPS and SMTPS share.

[Stefan Haberl]

@OctaviaTogami yes, it's the same reason. However, you have to set different properties for HTTP and SMTP to get this to work

[ArunM]

I will try this. But what is confusing is that we have enabled both to true in a different application in the same tomcat server and the mail just works fine. Is there anything here that could make it specific to a deployed application in tomcat ?

[Steffen Ullrich]

@ArunM: My guess is that it will not try explicit TLS (STARTTLS) if implicit TLS is already done because it does not make sense to do TLS inside TLS. This means that mail.smtp.starttls.enable will be implicitly ignored if mail.smtp.ssl.enable is true and thus any connections with port 465 (smtps) should just work.