Could not start TLS connection encryption protocol

[alfiosantoro]

Hi everyone, I have a problem that has already been addressed in this forum, but I can't find a solution that is right for me.
I use Hesk on a Windows 2016 server, on IIS:
Version Hesk: 2.8.5
Version PHP: 7.3.7 (MySQLi)
Version MySQL: 8.0.18

I use email forwarding via Exchange, and internally the mails are forwarded correctly if I leave the Username and Password fields empty. However, when I try to send a reply "outside" my organization (for example on a gmail mail) the message is not forwarded.
I tried to configure tls authentication on port 587, but I get the following error:

Could not start TLS connection encryption protocol
Resolving SMTP server domain "xxxxxxxxxx.xxxxx.xx"...
Connecting to SMTP server "xxxxxxxxxx.xxxxx.xx" port 587...
Connected to SMTP server "xxxxxxxxxxx.xxxxx.xx".
S 220 xxxxxxxxxx.xxxxx.xx Microsoft ESMTP MAIL Service ready at Thu, 5 Mar 2020 09:10:17 +0100
C EHLO srvweb2
S 250-xxxxxxxxxxx.xxxxx.xx Hello [192.168.10.36]
S 250-SIZE 30720000
S 250-PIPELINING
S 250-DSN
S 250-ENHANCEDSTATUSCODES
S 250-STARTTLS
S 250-X-ANONYMOUSTLS
S 250-AUTH GSSAPI NTLM
S 250-X-EXPS GSSAPI NTLM
S 250-8BITMIME
S 250-BINARYMIME
S 250-CHUNKING
S 250-XEXCH50
S 250-XRDST
S 250 XSHADOW
C STARTTLS
S 220 2.0.0 SMTP server ready
Starting TLS cryptograpic protocol

Can any of you give me any suggestions? Thank you.

[Klemen]

It's an SSL certificate mismatch, common on Windows servers.

See: viewtopic.php?t=6130

[alfiosantoro]

I solved it by creating a connector on the Exchange server, which would allow the Hesk server to send mail without authentication.

[Klemen]

Thanks for reporting your solution!

Are you able to provide any additional details (or link to a guide) that helped you solve it, so others with the same issue can try it?

[recusant]

Thanks for reporting your solution!

Are you able to provide any additional details (or link to a guide) that helped you solve it, so others with the same issue can try it?

We faced the same problem after moving to a new mail server and alfiosantoro's solution worked.
We need to create a new receive connector in exchange in frontend transport mode. In the security properties uncheck the TLS checkbox and enable the "external security (IPsec)" checkbox. And in the permissions group enable only "Exchange Servers"
On the "scope definition" tab remove the default value and add the IP address of Hesk.

I used the documentation - https://learn.microsoft.com/en-us/excha ... erver-2019

[Klemen]

Cheers, thanks for sharing; I hope this helps others, too!