I can't send emails on Ubuntu server [javax.net.ssl.SSLHandshakeException]

Question

I can't send emails on Unbuntu server suddenly.

It's happened since today. It's still working on local.

javax.mail.MessagingException: Could not convert socket to TLS;
nested exception is:
javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:1907)
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:666)

JAVA:
openjdk version "11.0.11" 2021-04-20
OpenJDK Runtime Environment (build 11.0.11+9-Ubuntu-0ubuntu2.20.04)
OpenJDK 64-Bit Server VM (build 11.0.11+9-Ubuntu-0ubuntu2.20.04, mixed mode, sharing)

Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384

Answer 1

It looks like your server uses TLSv1.1 or earlier, and you recently upgraded your Java to version 11.0.11. This version of Java has disabled TLSv1.0 and TLSv1.1 by default, see for example the Oracle Java 11.0.11 release notes (though AFAIK this applies to all OpenJDK-derived versions):

security-libs/javax.net.ssl
➜ Disable TLS 1.0 and 1.1

TLS 1.0 and 1.1 are versions of the TLS protocol that are no longer considered secure and have been superseded by more secure and modern versions (TLS 1.2 and 1.3).

These versions have now been disabled by default. If you encounter issues, you can, at your own risk, re-enable the versions by removing "TLSv1" and/or "TLSv1.1" from the jdk.tls.disabledAlgorithms security property in the java.security configuration file.

I suggest that you try if removing TLSv1.1 from the jdk.tls.disabledAlgorithms property in the java.security file fixes your problem, and if that fails, to try removing TLSv1. This would be an indication that your mailserver needs to be updated or configured to support more recent and more secure versions of TLS.

Answer 2

If you have ubuntu OS then go to

/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security

then find jdk.tls.disabledAlgorithms

Then remove TLSv1, TLSv1.1

reboot the server and try to send mail again.