Конечно - все настроено - между старым и новым и инетом (Компьютеры)

написал NоlZz©, Москва, 2025-05-13, 11:07 (472 дней назад) @ Remos

все бегает
старый цеаляется к эксчанге по TLS 1.2
проверка TLS со старого

===
[root@mail ~]# openssl s_client -connect mail.domain.local:25 -starttls smtp
CONNECTED(00000003)
depth=0 DC = serv-exx01, DC = domain, DC = local, CN = serv-exx01.domain.local
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 DC = serv-exx01, DC = domain, DC = local, CN = serv-exx01.domain.local
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/DC=serv-exx01/DC=domain/DC=local/CN=serv-exx01.domain.local
i:/DC=serv-exx01/DC=domain/DC=local/CN=serv-exx01.domain.local
---
Server certificate
-----BEGIN CERTIFICATE-----
БЛАБЛАБЛАБЛА
-----END CERTIFICATE-----
subject=/DC=serv-exx01/DC=domain/DC=local/CN=serv-exx01.domain.local
issuer=/DC=serv-exx01/DC=domain/DC=local/CN=serv-exx01.domain.local
---
No client certificate CA names sent
Peer signing digest: SHA1
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2017 bytes and written 506 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-SHA384
Session-ID: 721A0000B6AB7B9E080B45B6CEA983AD317EADEA6DB3CA1CBCC6F68E82437E44
Session-ID-ctx:
Master-Key: F1EF7264EA902F531CB1E5F57D1EEC6367C7F0B2413AB45443E4D59A97BF6FA3 8E9620EFA40B8C0B63E3F56D76C401D8
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1747056170
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
250 CHUNKING
===

Проверка с нового вызывает отвал

===
root@mail ~]# openssl s_client -connect mail.domain.local:25 -starttls smtp
Connecting to 192.168.10.8
CONNECTED(00000003)
003E294B377F0000:error:0A000126:SSL routines::unexpected eof while reading:ssl/record/rec_layer_s3.c:689:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 314 bytes and written 367 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
===

Причем мне пофиг - будет внутрях TLS или нет