RFC 8461 MTA-STS 를 적용한 메일서버엔
텔넷으로 접근을 하여 오픈릴레이 테스트가 불가능합니다.
openssl 로 접근하면 테스트가 가능합니다.
아래 예제를 첨부합니다:
soyeomul@yw-1130:~$ openssl s_client -starttls smtp -crlf -connect yw-1204.doraji.xyz:25
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = yw-1204.doraji.xyz
verify return:1
---
Certificate chain
0 s:CN = yw-1204.doraji.xyz
i:C = US, O = Let's Encrypt, CN = R3
1 s:C = US, O = Let's Encrypt, CN = R3
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFLDCCBBSgAwIBAgISA8Mzfr57A7aD6yIZ/zUa8rYrMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjAzMjQxOTExMjJaFw0yMjA2MjIxOTExMjFaMB0xGzAZBgNVBAMT
Enl3LTEyMDQuZG9yYWppLnh5ejCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAKXpEgDw37jT+khiJ5EqK0AkxGsj8jI/IEyCac95VlcqaTMuzIplDO5T01J1
hcxtG99J7HM24iE5BEN98sTWk1AJTSUpQEwSiZhVhkRGqt1agBivJC4qD0SNxCIA
eWLbNWHHur12du9kv4QHOgsjm7KLSbsH1wR+viRqvAKrH29/+ZVaBzUvRWHUt/9M
SRhfw9dLlfcT4AahcwRolKZ+XB2GwXTV3oKCcbyZkB7WPF0l82CWKLZO70hZ+Th/
M8p0tAMFgF+exNa3E4PUDLEJtuPKQMnmQgl9Rent9doK+IPWO8X9ChAWnrg7IItK
YjSX0oSu6FHApVWwm1Lj7BWtvK0CAwEAAaOCAk8wggJLMA4GA1UdDwEB/wQEAwIF
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
BgNVHQ4EFgQUwwiV9vC56w7IuxCf32oi5byonSEwHwYDVR0jBBgwFoAUFC6zF7dY
VsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRw
Oi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNy
Lm9yZy8wHQYDVR0RBBYwFIISeXctMTIwNC5kb3JhamkueHl6MEwGA1UdIARFMEMw
CAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9j
cHMubGV0c2VuY3J5cHQub3JnMIIBBgYKKwYBBAHWeQIEAgSB9wSB9ADyAHcA36Ve
q2iCTx9sre64X04+WurNohKkal6OOxLAIERcKnMAAAF/vY4gEAAABAMASDBGAiEA
4Ny2FOvtkO1muLPAsCMYCKksY7759si9f/eZOdcbMpgCIQCRBwpQiJFNbHEkevGF
KQwvvbsvDP22lPoRNXwcQigHxgB3ACl5vvCeOTkh8FZzn2Old+W+V32cYAr4+U1d
JlwlXceEAAABf72OIAMAAAQDAEgwRgIhAORDxSREjp/OIU3ohD+oPnRAGqMF6hxr
KVlBnSIkMaGiAiEA18pn2hzx8XTseswt1/zmuLvHQHgOsgFO4x0dLbI7joMwDQYJ
KoZIhvcNAQELBQADggEBAETlJGsj7in7Ur2+5T+sm1I+aVdZmrbaZeU1tT8CECzK
awyD2hVK5o2uq0DNrwErcWN+xKupN4La/tvP0uPIh7haOw0yoo4sIQ6D+TcpUeRz
s3S2Q6oc+M8HEGpXkI6FKGgsOLXEuHmUoe4g2naPrnlj5DbwUwA/asrWWigWxR4d
a+RgriYzSIgs5n9VPirEFsndQisLU4K94YFn3kddaHmyWemW2ZxiOK+75AjQrmmZ
ZH5RCJipAGp5rsthh+goj0bFFkBeBzpeToFlrhF15k98Rox9Kgs6UhDnG2CIPjul
JjsbVMvT03d7WJP/m7yeoPdtEVhFNUlhSbHGJKgL6Vw=
-----END CERTIFICATE-----
subject=CN = yw-1204.doraji.xyz
issuer=C = US, O = Let's Encrypt, CN = R3
---
Acceptable client certificate CA names
CN = ACCVRAIZ1, OU = PKIACCV, O = ACCV, C = ES
C = ES, O = FNMT-RCM, OU = AC RAIZ FNMT-RCM
C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
C = US, O = AffirmTrust, CN = AffirmTrust Commercial
C = US, O = AffirmTrust, CN = AffirmTrust Networking
C = US, O = AffirmTrust, CN = AffirmTrust Premium
C = US, O = AffirmTrust, CN = AffirmTrust Premium ECC
C = US, O = Amazon, CN = Amazon Root CA 1
C = US, O = Amazon, CN = Amazon Root CA 2
C = US, O = Amazon, CN = Amazon Root CA 3
C = US, O = Amazon, CN = Amazon Root CA 4
CN = Atos TrustedRoot 2011, O = Atos, C = DE
C = ES, CN = Autoridad de Certificacion Firmaprofesional CIF A62634068
C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
C = NO, O = Buypass AS-983163327, CN = Buypass Class 2 Root CA
C = NO, O = Buypass AS-983163327, CN = Buypass Class 3 Root CA
C = SK, L = Bratislava, O = Disig a.s., CN = CA Disig Root R2
C = FR, O = Dhimyotis, CN = Certigna
C = FR, O = Dhimyotis, OU = 0002 48146308100036, CN = Certigna Root CA
C = RO, O = certSIGN, OU = certSIGN ROOT CA
C = RO, O = CERTSIGN SA, OU = certSIGN ROOT CA G2
C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
C = CN, O = China Financial Certification Authority, CN = CFCA EV ROOT
C = EU, L = Madrid (see current address at www.camerfirma.com/address), serialNumber = A82743287, O = AC Camerfirma S.A., CN = Chambers of Commerce Root - 2008
C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO Certification Authority
C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO ECC Certification Authority
C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
O = "Cybertrust, Inc", CN = Cybertrust Global Root
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root G2
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root G3
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G3
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4
O = Digital Signature Trust Co., CN = DST Root CA X3
C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
C = ES, O = Agencia Catalana de Certificacio (NIF Q-0801176-I), OU = Serveis Publics de Certificacio, OU = Vegeu https://www.catcert.net/verarrel (c)03, OU = Jerarquia Entitats de Certificacio Catalanes, CN = EC-ACC
C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
O = Entrust.net, OU = www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU = (c) 1999 Entrust.net Limited, CN = Entrust.net Certification Authority (2048)
C = US, O = "Entrust, Inc.", OU = www.entrust.net/CPS is incorporated by reference, OU = "(c) 2006 Entrust, Inc.", CN = Entrust Root Certification Authority
C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2012 Entrust, Inc. - for authorized use only", CN = Entrust Root Certification Authority - EC1
C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2009 Entrust, Inc. - for authorized use only", CN = Entrust Root Certification Authority - G2
C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms, OU = "(c) 2015 Entrust, Inc. - for authorized use only", CN = Entrust Root Certification Authority - G4
C = TW, O = "Chunghwa Telecom Co., Ltd.", OU = ePKI Root Certification Authority
C = HU, L = Budapest, O = Microsec Ltd., organizationIdentifier = VATHU-23584497, CN = e-Szigno Root CA 2017
C = TR, L = Ankara, O = E-Tu\C4\9Fra EBG Bili\C5\9Fim Teknolojileri ve Hizmetleri A.\C5\9E., OU = E-Tugra Sertifikasyon Merkezi, CN = E-Tugra Certification Authority
C = CN, O = "GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.", CN = GDCA TrustAUTH R5 ROOT
C = US, O = GeoTrust Inc., OU = (c) 2007 GeoTrust Inc. - For authorized use only, CN = GeoTrust Primary Certification Authority - G2
C = EU, L = Madrid (see current address at www.camerfirma.com/address), serialNumber = A82743287, O = AC Camerfirma S.A., CN = Global Chambersign Root - 2008
OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2
C = US, O = Google Trust Services LLC, CN = GTS Root R1
C = US, O = Google Trust Services LLC, CN = GTS Root R2
C = US, O = Google Trust Services LLC, CN = GTS Root R3
C = US, O = Google Trust Services LLC, CN = GTS Root R4
C = GR, L = Athens, O = Hellenic Academic and Research Institutions Cert. Authority, CN = Hellenic Academic and Research Institutions ECC RootCA 2015
C = GR, O = Hellenic Academic and Research Institutions Cert. Authority, CN = Hellenic Academic and Research Institutions RootCA 2011
C = GR, L = Athens, O = Hellenic Academic and Research Institutions Cert. Authority, CN = Hellenic Academic and Research Institutions RootCA 2015
C = HK, O = Hongkong Post, CN = Hongkong Post Root CA 1
C = HK, ST = Hong Kong, L = Hong Kong, O = Hongkong Post, CN = Hongkong Post Root CA 3
C = US, O = IdenTrust, CN = IdenTrust Commercial Root CA 1
C = US, O = IdenTrust, CN = IdenTrust Public Sector Root CA 1
C = US, O = Internet Security Research Group, CN = ISRG Root X1
C = ES, O = IZENPE S.A., CN = Izenpe.com
C = HU, L = Budapest, O = Microsec Ltd., CN = Microsec e-Szigno Root CA 2009, emailAddress = info@e-szigno.hu
C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
C = KR, O = NAVER BUSINESS PLATFORM Corp., CN = NAVER Global Root Certification Authority
C = HU, L = Budapest, O = NetLock Kft., OU = Tan\C3\BAs\C3\ADtv\C3\A1nykiad\C3\B3k (Certification Services), CN = NetLock Arany (Class Gold) F\C5\91tan\C3\BAs\C3\ADtv\C3\A1ny
C = US, O = Network Solutions L.L.C., CN = Network Solutions Certificate Authority
C = CH, O = WISeKey, OU = OISTE Foundation Endorsed, CN = OISTE WISeKey Global Root GB CA
C = CH, O = WISeKey, OU = OISTE Foundation Endorsed, CN = OISTE WISeKey Global Root GC CA
C = BM, O = QuoVadis Limited, CN = QuoVadis Root CA 1 G3
C = BM, O = QuoVadis Limited, CN = QuoVadis Root CA 2
C = BM, O = QuoVadis Limited, CN = QuoVadis Root CA 2 G3
C = BM, O = QuoVadis Limited, CN = QuoVadis Root CA 3
C = BM, O = QuoVadis Limited, CN = QuoVadis Root CA 3 G3
C = BM, O = QuoVadis Limited, OU = Root Certification Authority, CN = QuoVadis Root Certification Authority
C = US, O = SecureTrust Corporation, CN = Secure Global CA
C = JP, O = "Japan Certification Services, Inc.", CN = SecureSign RootCA11
C = US, O = SecureTrust Corporation, CN = SecureTrust CA
C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
C = FI, O = Sonera, CN = Sonera Class2 CA
C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority
C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Root Certificate Authority - G2
C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
C = PL, O = Krajowa Izba Rozliczeniowa S.A., CN = SZAFIR ROOT CA2
O = TeliaSonera, CN = TeliaSonera Root CA v1
C = PA, ST = Panama, L = Panama City, O = TrustCor Systems S. de R.L., OU = TrustCor Certificate Authority, CN = TrustCor ECA-1
C = PA, ST = Panama, L = Panama City, O = TrustCor Systems S. de R.L., OU = TrustCor Certificate Authority, CN = TrustCor RootCert CA-1
C = PA, ST = Panama, L = Panama City, O = TrustCor Systems S. de R.L., OU = TrustCor Certificate Authority, CN = TrustCor RootCert CA-2
C = GB, O = Trustis Limited, OU = Trustis FPS Root CA
C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
C = TR, L = Gebze - Kocaeli, O = Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK, OU = Kamu Sertifikasyon Merkezi - Kamu SM, CN = TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1
C = TW, O = TAIWAN-CA, OU = Root CA, CN = TWCA Global Root CA
C = TW, O = TAIWAN-CA, OU = Root CA, CN = TWCA Root Certification Authority
C = CN, O = UniTrust, CN = UCA Extended Validation Root
C = CN, O = UniTrust, CN = UCA Global G2 Root
C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust ECC Certification Authority
C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2008 VeriSign, Inc. - For authorized use only", CN = VeriSign Universal Root Certification Authority
C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1
Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 18926 bytes and written 453 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
250 CHUNKING
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: B386F4895647C79643B87F2FAD740112009DD09D9C8DB3E88538D2C5516E2C20
Session-ID-ctx:
Resumption PSK: D47D1E707E5A25FDE749B60B056FA9ED4BA2D49B8939E1C0E26A536541FD92B384005B3A24F68DE3828BA5FCF32859A3
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 77 b2 fe 05 7a da 36 63-57 ae a2 f5 4a f8 80 d7 w...z.6cW...J...
0010 - 99 e3 e8 72 40 b0 7a a4-b4 c0 16 8d 3c 97 b8 e8 ...r@.z.....<...
0020 - 43 ad 02 19 45 3d e0 da-a8 26 9a 35 ea b3 86 b2 C...E=...&.5....
0030 - 9d 68 9b c1 47 df bc 66-9e 7a cd bb 00 15 5c 64 .h..G..f.z....\d
0040 - 6e ca cb 7f ef 5a 99 ab-76 a6 20 3f e0 64 4b 1b n....Z..v. ?.dK.
0050 - 52 5d 05 72 67 ad d9 01-f5 04 e1 c3 18 d1 99 77 R].rg..........w
0060 - 2f a9 ca 47 29 df 55 cf-24 de 6f d0 72 a8 b0 12 /..G).U.$.o.r...
0070 - 07 4e a7 ed a8 63 8b f4-74 c0 f7 7e b4 4e 26 66 .N...c..t..~.N&f
0080 - d7 98 b8 8b 7d 01 da df-ab 84 0e 7b 1c 37 1a 0c ....}......{.7..
0090 - 11 43 fb df e1 07 42 70-bd b9 34 ab 31 4f 89 1a .C....Bp..4.1O..
00a0 - 5a ea f1 de ea 84 89 c6-00 b0 50 eb db 46 7e 67 Z.........P..F~g
00b0 - e6 f1 55 f0 2c c5 7f 00-f1 a0 07 ba 73 c2 67 7d ..U.,.......s.g}
00c0 - 76 ed 12 25 10 01 40 bd-b1 36 5a dd 47 78 d9 b0 v..%..@..6Z.Gx..
Start Time: 1650883313
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
ehlo delta
250-yw-1204.doraji.xyz
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
mail from:<test@example.xyz>
250 2.1.0 Ok
rcpt to:<test@example.io>
454 4.7.1 <test@example.io>: Relay access denied
quit
221 2.0.0 Bye
closed
soyeomul@yw-1130:~$
참고문헌:
- https://wiki.zimbra.com/wiki/Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl
- https://mta-sts.doraji.xyz/.well-known/mta-sts.txt
[데비안 11 ibus-hangul 에서 적었어유~ 파여폭스~]