"(SSL_accept): error:20074002: BIO routines:FILE_CTRL:system lib" error in Exim log

This template is in trial mode. Please do not use this template unless you have been authorized to do so by your Supervisor. Thanks!

Ticket Subject(s)

(paste the subject of the ticket here. upon adding the 4th ticket subject, submit article For Review after editing)

• DNS

• error:20074002:BIO routines:FILE_CTRL:system lib

• DNS/SSL error when sending email

• SSL errors on delivery from gmail

Customer Request Summary

(in a sentence or two, describe the issue from the perspective of the customer)

• Customer got this error when attempting to send mail from Outlook:

Your server does not support the connection encryption type you have specified. Try changing the encryption method. Contact your mail server administrator or Internet service provider (ISP) for additional assistance.

• After restoring the server from backups, Exim is logging:

2022-08-14 19:53:42 TLS error on connection from o13.email.nextdoor.com [167.89.72.111]:61896 (SSL_accept): error:20074002:BIO routines:FILE_CTRL:system lib

• We had an issue on this server where it looks like ownership/group permissions were set as "root:root" across some important CPanel directories. I believe we have most of it straight but I can't figure out why we're getting "SSL peer has no cerficate for the requested DNS name" errors when trying to send emails.

• Bounce from gmail TLS Negotiation failed: FAILED_PRECONDITION: starttls error (71): 24205275173696:error:10000458:SSL routines:OPENSSL_internal:TLSV1_ALERT_UNRECOGNIZED_NAME:third_party/openssl/boringssl/src/ssl/tls_record.cc:592:SSL alert number 112

Workarounds

(if no known workaround, leave blank)

• Corrected group ownership on files in /var/cpanel that were set to man instead of mail and restarted Exim

• https://cpanel.zendesk.com/agent/tickets/94474810 - Advised changing the files in /var/cpanel/ssls/domain_tls owned by root:daemon to root:mail

• https://cpanel.zendesk.com/agent/tickets/95160782 `/var/cpanel/ssl/domain_tls` recursive root:root -> root:mail

• https://cpanel.zendesk.com/agent/tickets/95228476 - same as above, was owned by root:man

find /var/cpanel/ssl/domain_tls/ -group "man" -exec chown :mail {} \;

Links to relevant information or resources

(optional and no restrictions on sources)

• [placeholder for source link]

• [placeholder for source link]

• [placeholder for source link]

• [placeholder for source link]