Unable to send mails - TLS/Java error
Asked by vaday:

All other services work perfectly except BITBUCKET. Recently, the mail service stopped and the log reflects below (Office 365)

org.springframework.mail.MailSendException: Mail server connection failed; nested exception is javax.mail.MessagingException: Could not convert socket to TLS;  
nested exception is:  
javax.net.ssl.SSLHandshakeException: A potential protocol version downgrade attack. Failed messages: javax.mail.MessagingException: Could not convert socket to TLS;  
nested exception is:  
javax.net.ssl.SSLHandshakeException: A potential protocol version downgrade attack  
at org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:448)  
at org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:361)  
at org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:378)  
at org.springframework.mail.javamail.JavaMailSenderImpl.send(JavaMailSenderImpl.java:366)  
at com.atlassian.stash.internal.mail.MailServiceImpl.sendMessageSynchronously(MailServiceImpl.java:286)  
at com.atlassian.stash.internal.mail.MailServiceImpl.lambda$submit$0(MailServiceImpl.java:162)  
at com.atlassian.stash.internal.concurrent.StateTransferringRunnable.run(StateTransferringRunnable.java:50)  
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)  
at java.util.concurrent.FutureTask.run(Unknown Source)  
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)  
at java.lang.Thread.run(Unknown Source)  
... 1 frame trimmed  
Caused by: javax.mail.MessagingException: Could not convert socket to TLS  
at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2064)  
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:724)  
at javax.mail.Service.connect(Service.java:366)  
at org.springframework.mail.javamail.JavaMailSenderImpl.connectTransport(JavaMailSenderImpl.java:518)  
at org.springframework.mail.javamail.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:437)  
... 11 common frames omitted  
Caused by: javax.net.ssl.SSLHandshakeException: A potential protocol version downgrade attack  
at sun.security.ssl.Alert.createSSLException(Unknown Source)  
at sun.security.ssl.Alert.createSSLException(Unknown Source)  
at sun.security.ssl.TransportContext.fatal(Unknown Source)  
at sun.security.ssl.TransportContext.fatal(Unknown Source)  
at sun.security.ssl.TransportContext.fatal(Unknown Source)  
at sun.security.ssl.ServerHello$ServerHelloConsumer.onServerHello(Unknown Source)  
at sun.security.ssl.ServerHello$ServerHelloConsumer.consume(Unknown Source)  
at sun.security.ssl.SSLHandshake.consume(Unknown Source)  
at sun.security.ssl.HandshakeContext.dispatch(Unknown Source)  
at sun.security.ssl.HandshakeContext.dispatch(Unknown Source)  
at sun.security.ssl.TransportContext.dispatch(Unknown Source)  
at sun.security.ssl.SSLTransport.decode(Unknown Source)  
at sun.security.ssl.SSLSocketImpl.decode(Unknown Source)  
at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)  
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)  
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)  
at com.sun.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:598)  
at com.sun.mail.util.SocketFetcher.startTLS(SocketFetcher.java:525)  
at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2059)  
... 15 common frames omitted


Answers:
author: Andy Heinzer
body: Hi [@vaday](/t5/user/viewprofilepage/user-id/349551)

Sorry to hear about this problem. I did some searching on this error and I came across this bug: [BSERV-11889](https://jira.atlassian.com/browse/BSERV-11889). It appears that Bitbucket server, by default is not enforcing TLS 1.2, and there is a known change that has recently been implemented by Office 365 to deprecate the older 1.0 and 1.1 versions of TLS. I suspect that Bitbucket is trying to use a different version of this protocol that is not being accepted by the mail host (Office 365).

The good news is that there is a work-around you can follow in order to force Bitbucket to always connect using the 1.2 version of that protocol by [editing the bitbucket.properties](https://confluence.atlassian.com/bitbucketserver/bitbucket-server-config-properties-776640155.html) file:
>
> ### Workaround: {#toc-hId-1175782335}
>
> 1. Add the following setting to bitbucket.properties:  
>
>    ```
>    mail.crypto.protocols=TLSv1.2
>    ```
>
> 2. Restart Bitbucket

Try these steps and let me know if this helps.

Andy

comments: author: vaday
body: Andy, thanks. I was trying the same but from JAVA side and it did not work. It works with above solution. Very helpful.


author: Andy Heinzer
body: Thanks [@vaday](/t5/user/viewprofilepage/user-id/349551). If this solved your problem here, please click the Accept Answer button. This will help to mark the question as answered, and in turn can help other users that might run across the same error.

Cheers,

Andy


Tags: bitbucket-server

server