old TLS version is not supported in SMTP auth method #13330

New Issue

GiteaMirror · 2025-11-02T10:38:45-06:00

GiteaMirror commented

2025-11-02 10:38:45 -06:00

Originally created by @6769 on GitHub (Jul 25, 2024).

Description

Steps:

add a new SMTP auth method, SMTP server which is using TLS1.0 and support the STARTTLS extension: https://docs.gitea.com/usage/authentication#smtp-simple-mail-transfer-protocol ;
add a normal user login with SMTP auth;
login will error 500

When the remote SMTP server is using the outdated TLS version (1.0-1.1),
golang crypto/tls package using default Config will reject to establish tls connection with remote server, and result in the login method failure.

log output:

...ers/web/auth/auth.go:249:SignInPost() [E] UserSignIn: failed to start StartTLS: remote error: tls: handshake failure

code line patch:

func Authenticate(a smtp.Auth, source *Source) error {
        tlsConfig := &tls.Config{
                InsecureSkipVerify: source.SkipVerify,
                ServerName:         source.Host,
+               MinVersion: tls.VersionTLS10,       //  By default, TLS 1.2 is currently used as the minimum.
        }

Gitea Version

1.22.1

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Ubuntu 18.04.6 LTS

How are you running Gitea?

download precompiled binary file and run

Database

SQLite

Originally created by @6769 on GitHub (Jul 25, 2024). ### Description Steps: 1. add a new SMTP auth method, SMTP server which is using TLS1.0 and support the STARTTLS extension: https://docs.gitea.com/usage/authentication#smtp-simple-mail-transfer-protocol ; 2. add a normal user login with SMTP auth; 3. login will error 500 When the remote SMTP server is using the outdated TLS version (1.0-1.1), golang `crypto/tls` package using default [`Config`](https://pkg.go.dev/crypto/tls#Config) will reject to establish tls connection with remote server, and result in the login method failure. log output: ``` ...ers/web/auth/auth.go:249:SignInPost() [E] UserSignIn: failed to start StartTLS: remote error: tls: handshake failure ``` code [line](https://github.com/go-gitea/gitea/blob/main/services/auth/source/smtp/auth.go#L60) patch: ``` func Authenticate(a smtp.Auth, source *Source) error { tlsConfig := &tls.Config{ InsecureSkipVerify: source.SkipVerify, ServerName: source.Host, + MinVersion: tls.VersionTLS10, // By default, TLS 1.2 is currently used as the minimum. } ``` ### Gitea Version 1.22.1 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System Ubuntu 18.04.6 LTS ### How are you running Gitea? download precompiled binary file and run ### Database SQLite

GiteaMirror added the type/bug label 2025-11-02 10:38:45 -06:00

GiteaMirror closed this issue

2025-11-02 10:38:46 -06:00

GiteaMirror commented

2025-11-02 10:38:47 -06:00

@levicki commented on GitHub (Jul 25, 2024):

When the remote SMTP server is using the outdated TLS version (1.0-1.1),
golang crypto/tls package using default Config will reject to establish tls connection with remote server, and result in the login method failure.

As it well should.

Anything lower than TLS 1.2 should not be used today.

You should really upgrade that server to TLS 1.2 instead of asking devs to make less secure default configuration for everyone.

@levicki commented on GitHub (Jul 25, 2024): > When the remote SMTP server is using the outdated TLS version (1.0-1.1), golang crypto/tls package using default [Config](https://pkg.go.dev/crypto/tls#Config) **will reject to establish tls connection with remote server**, and result in the login method failure. As it well should. Anything lower than TLS 1.2 should not be used today. You should really upgrade that server to TLS 1.2 instead of asking devs to make less secure default configuration for everyone.

GiteaMirror commented

2025-11-02 10:38:47 -06:00

@silverwind commented on GitHub (Jul 25, 2024):

The minimum TLS version is a limitation of golang, not us. Same issue as https://github.com/go-gitea/gitea/issues/31228 basically. If you really have to workaround, you can try adding the GODEBUG="tlsrsakex=1" environment variable, but that will be going away in a future golang version and you should strongly consider upgrading your SMTP server.

@silverwind commented on GitHub (Jul 25, 2024): The minimum TLS version is a limitation of golang, not us. Same issue as https://github.com/go-gitea/gitea/issues/31228 basically. If you really have to workaround, you can try adding the `GODEBUG="tlsrsakex=1"` environment variable, but that will be going away in a future golang version and you should strongly consider upgrading your SMTP server.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13330