🐛: "peer is incompatible: UnsolicitedCertificateTypeExtension"

[xyzst]

What happened?

I am trying to publish a PGP key on "keys.openpgp.org" key server and I am not able to receive the validation e-mail to my Stalwart mail server.

I inspected the logs on my server with "trace" enabled and found 2 possible issues with receiving mail:

2025-03-28T00:08:42Z INFO SPF EHLO check failed (smtp.spf-ehlo-fail) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, domain = "mail.keys.openpgp.org", result = No SPF record (spf.none), elapsed = 160ms

This shouldn't cause any issue with receiving mail here since it's using the default of relaxed.

But then a second log statement caught my eye:

2025-03-28T00:08:42Z DEBUG TLS handshake error (tls.handshake-error) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, listenerId = "smtp", reason = "peer is incompatible: UnsolicitedCertificateTypeExtension"

It's not exactly clear what's going on here, but seems to be relevant. Certificates are issued by Lets Encrypt CAs via ACME + Cloudflare automated workflow.

Deployment Topology:

• Docker Compose
• stalwartlabs/mail-server:v0.11.7-alpine@sha256:62c7ab98ea741c5b0d038cc3091f4c4de7ca0b5679330fb0d89d33e27dfb8d58

How can we reproduce the problem?

I can reproduce the problem by doing the following steps:

1. Create PGP public/private key pair and use e-mail address for mail server (I used Thunderbird mail client to generate the key pair)
2. Upload public key file to https://keys.openpgp.org
3. Verify ownership of the PGP public key by verifying e-mail address

Expected: verification email from [email protected]
Actual: no e-mail received

Version

v0.11.x

What database are you using?

RocksDB

What blob storage are you using?

RocksDB

Where is your directory located?

Internal

What operating system are you using?

Docker

Relevant log output

2025-03-28T00:08:42Z DEBUG SMTP connection started (smtp.connection-start) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778
2025-03-28T00:08:42Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 2
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.transfer-limit", result = "Integer(262144000)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.duration", result = "Integer(600000)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.timeout", result = "Integer(300000)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "auth.spf.verify.ehlo", result = "Integer(2)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "auth.spf.verify.mail-from", result = "Integer(2)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "auth.iprev.verify", result = "Integer(2)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.ehlo.require", result = "Integer(1)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.ehlo.reject-non-fqdn", result = "Integer(1)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.auth.directory", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.auth.directory", result =
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.auth.require", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.auth.errors.total", result = "Integer(3)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.auth.errors.wait", result = "Integer(5000)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.expn", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.vrfy", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.connect.script", result =
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "server.connect.hostname", result = "String("mail.example.com")"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.connect.greeting", result = "String("mail.example.com Stalwart ESMTP at your service")"
2025-03-28T00:08:42Z TRACE Raw SMTP output sent (smtp.raw-output) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, size = 55, contents = "220 mail.example.com Stalwart ESMTP at your service\r\n"
2025-03-28T00:08:42Z TRACE Raw SMTP input received (smtp.raw-input) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, size = 28, contents = "EHLO mail.keys.openpgp.org\r\n"
2025-03-28T00:08:42Z INFO SMTP EHLO command (smtp.ehlo) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, domain = "mail.keys.openpgp.org"
2025-03-28T00:08:42Z INFO SPF EHLO check failed (smtp.spf-ehlo-fail) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, domain = "mail.keys.openpgp.org", result = No SPF record (spf.none), elapsed = 160ms
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "report.spf.send", result = "Array([Integer(1), Integer(86400000)])"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.ehlo.script", result =
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.pipelining", result = "Integer(1)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.chunking", result = "Integer(1)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.expn", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.vrfy", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.requiretls", result = "Integer(1)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.dsn", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.auth.mechanisms", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.future-release", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.future-release", result =
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.deliver-by", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.deliver-by", result =
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.mt-priority", result = "Integer(0)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.mt-priority", result =
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.data.limits.size", result = "Integer(104857600)"
2025-03-28T00:08:42Z TRACE Expression evaluation result (eval.result) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, id = "session.extensions.no-soliciting", result = "String("")"
2025-03-28T00:08:42Z TRACE Raw SMTP output sent (smtp.raw-output) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, size = 211, contents = "250-mail.example.com you had me at EHLO\r\n250-STARTTLS\r\n250-SMTPUTF8\r\n250-SIZE 104857600\r\n250-REQUIRETLS\r\n250-PIPELINING\r\n250-NO-SOLICITING\r\n250-ENHANCEDSTATUSCODES\r\n250-CHUNKING\r\n250-BINARYMIME\r\n250 8BITMIME\r\n"
2025-03-28T00:08:42Z TRACE Raw SMTP input received (smtp.raw-input) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, size = 10, contents = "STARTTLS\r\n"
2025-03-28T00:08:42Z DEBUG SMTP STARTTLS command (smtp.start-tls) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778
2025-03-28T00:08:42Z TRACE Raw SMTP output sent (smtp.raw-output) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, size = 31, contents = "220 2.0.0 Ready to start TLS.\r\n"
2025-03-28T00:08:42Z DEBUG TLS handshake error (tls.handshake-error) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, listenerId = "smtp", reason = "peer is incompatible: UnsolicitedCertificateTypeExtension"
2025-03-28T00:08:42Z DEBUG SMTP connection ended (smtp.connection-end) listenerId = "smtp", localPort = 25, remoteIp = 128.140.9.252, remotePort = 48778, elapsed = 227ms

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

This might be related to this rusttls bug which unfortunately can't be fixed from Stalwart. Can you try using a different certificate in your server? For example, one issued by Let's Encrypt.

[xyzst]

hi @mdecimus - the mail server currently has certificates issued by production Let’s Encrypt CAs.

I came across that as well in my own research so used dumpcap to capture the packets and analyze in wireshark.

I wasn’t able to make heads or tails on it though with the capture though. I just noticed mail server was issuing/sending a “Change Cipher Spec” after a couple of exchanges then communication drops between the two mail servers.

So I’m leaning towards, yes that is likely the issue but not entirely confident.

I have tried using this service (https://keys.openpgp.org/) with a e-mail not backed by Stalwart (ie, dovecot and postfix), and was able to receive it just fine.