Mailkit: SslHandshakeException on attempt to connect to OVH mail

[RyanTT]

So, I'm sorry this has resulted in me making an issue, but right now I'm either blindly not seeing something very obviously or something is wrong ^^.

I've made sure the credentials and connection data is correct, Thunderbird and other clients work just fine while trying to send a mail with smtp.

MailKit Version 2.0.6
Framework NET Core 2.0
Host ssl0.ovh.net
Port 465

I've attempted to send mail like this

        private void Send(MimeMessage message) {
            using (var client = new SmtpClient(new ProtocolLogger("mail.log"))) {
                client.Connect("ssl0.ovh.net", 465, MailKit.Security.SecureSocketOptions.Auto);

                // Authenticate
                client.Authenticate($"{_config.SenderUsername}@{_config.Domain}", _config.SenderPassword);

                // Send the message
                client.Send(message);
                client.Disconnect(true);
            }
        }

aswell as with these connect variations:

client.Connect(new Uri("smtps://ssl0.ovh.net:465/"));
client.Connect("ssl0.ovh.net", 465, MailKit.Security.SecureSocketOptions.SslOnConnect);
client.Connect("ssl0.ovh.net", 465, true);

However the issue is that most of the time (I'd say 90% of all attempts), the connect method throws a SslHandshakeException. However without changing any code and just retrying by restarting the application, the remaining 10% it sends the mail just fine without any further issues.

Other applications such as Thunderbird are able to send mails 100% of the time on their first attempt (I've checked my SMTP log of Thunderbird).

When the exception arises, the specified mail.log file won't print out any information.
On successfull attempts, this is the mail.log file's output:

Connected to smtp://ssl0.ovh.net:465/?starttls=when-available
Connected to smtp://ssl0.ovh.net:465/?starttls=always
Connected to smtps://ssl0.ovh.net:465/
S: 220 ssl0.ovh.net player729
C: EHLO [148.251.92.113]
S: 250-player729.ha.ovh.net
S: 250-SIZE 104857600
S: 250-AUTH PLAIN LOGIN
S: 250-AUTH=PLAIN LOGIN
S: 250-ENHANCEDSTATUSCODES
S: 250 8BITMIME
C: AUTH PLAIN <REMOVED>
S: 235 2.7.0 Authentication successful
C: MAIL FROM:<<REMOVED>> BODY=8BITMIME
S: 250 2.1.0 Ok
C: RCPT TO:<<REMOVED>>
S: 250 2.1.5 Ok
...
C: QUIT
S: 221 2.0.0 Bye

I'm all out of ideas now what could be the reason for this behaviour. According to the OVH documentation, I should be using SSL from the getgo when establishing my connection. I've attempted to run the application both on my development and production machine, and both show the same behaviour. I've tried downgrading to a previous version of MailKit with no success aswell. The fact that it sometimes works and sometimes doesn't is really melting my brain.

I hope you're able to send me off to the right direction with this one.

[jstedfast]

This might be helpful: https://github.com/jstedfast/MailKit/blob/master/FAQ.md#InvalidSslCertificate

[RyanTT]

Hi, thanks for the quick answer. Should have written that I've tried that already, sadly with no success.

```csharp
private void Send(MimeMessage message) {
using (var client = new SmtpClient(new ProtocolLogger("mail.log"))) {
client.ServerCertificateValidationCallback = (s, c, h, e) => true;
client.Connect("ssl0.ovh.net", 465, MailKit.Security.SecureSocketOptions.Auto);

            // Authenticate
            client.Authenticate($"{_config.SenderUsername}@{_config.Domain}", _config.SenderPassword);

            // Send the message
            client.Send(message);
            client.Disconnect(true);
        }
    }

[jstedfast]

I'm not sure what else to suggest :-\

All of the SSL stuff is handled by core .NET libraries, MailKit doesn't do anything special at all.

Can you write a simple .NET program that connects to that host using SslStream to see if you get the same error?

[jstedfast]

Here's a simple test case:

using System;
using System.Net;
using System.Text;
using System.Net.Sockets;
using System.Net.Security;
using System.Security.Authentication;

namespace SslConnect
{
    class Program
    {
        const SslProtocols DefaultSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;

        public static void Main (string[] args)
        {
            var host = "ssl0.ovh.net";
            int port = 465;

            IPAddress[] ipAddresses;
            Socket socket = null;

            ipAddresses = Dns.GetHostAddressesAsync (host).GetAwaiter ().GetResult ();

            for (int i = 0; i < ipAddresses.Length; i++) {
                socket = new Socket (ipAddresses[i].AddressFamily, SocketType.Stream, ProtocolType.Tcp);

                try {
                    socket.Connect (ipAddresses[i], port);
                    break;
                } catch {
                    socket.Dispose ();
                    socket = null;

                    if (i + 1 == ipAddresses.Length)
                        throw;
                }
            }

            if (socket == null) {
                Console.WriteLine ("Failed to resolve host: {0}", host);
                return;
            }

            using (var network = new NetworkStream (socket, true)) {
                using (var ssl = new SslStream (network, true)) {
                    ssl.AuthenticateAsClientAsync (host, null, DefaultSslProtocols, true).GetAwaiter ().GetResult ();

                    var buffer = new byte[1024];
                    int nread;

                    nread = ssl.Read (buffer, 0, buffer.Length);

                    Console.WriteLine ("S: {0}", Encoding.UTF8.GetString (buffer, 0, nread));
                }
            }
        }
    }
}

[jstedfast]

It would be helpful to know:

1. Does this work for you using .NET 4.5/4.6 (i.e. a desktop version of .NET)
2. Does this work for you using .NET Core?

If it fails, what is the exception message/stacktrace?

[RyanTT]

Thanks, will let you know in a minute!

[RyanTT]

I've ran the example code on the different framework versions multiple times each on NET Core 2.1, 2 and NET 4.5, 4.6 and it appears to be working on all of them.

This is a really weird issue.. I can only assume it had something to do with the host at that time because right now it's not happening anymore at all. Sorry for the trouble, if the issue returns I'll re-run the tests in hopes of getting a stacktrace!

Big thanks for your help and your time, pass me your PayPal and I'll pass you a beer 👍

[jstedfast]

Glad everything is working again :)

Donations link is here: https://www.paypal.com/pools/c/857bGigSJE

[wartab]

Just fyi, OVH indeed had issues yesterday: http://travaux.ovh.net/?do=details&id=34511

[jstedfast]

Thanks for the donation, btw :)