Just a heads up for the devs here:
As reported in another thread, I have been having some error messages in my MIAB status page about not having MTA-STS policies on the domains my MIAB was handling. Before I had finished setting up the MTA-STS policies [which took a day or two, as I was working on other stuff too] I received a few of the ‘Status Checks Change Notice’ emails. However, in those emails, the errors themselves were mostly obscured by a Python exception traceback:
Exception in callback None()
handle: <Handle cancelled>
Traceback (most recent call last):
File "/usr/lib/python3.6/asyncio/events.py", line 145, in _run
self._callback(*self._args)
File "/usr/lib/python3.6/asyncio/selector_events.py", line 721, in _read_ready
self._protocol.data_received(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 505, in data_received
ssldata, appdata = self._sslpipe.feed_ssldata(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 201, in feed_ssldata
self._sslobj.do_handshake()
File "/usr/lib/python3.6/ssl.py", line 694, in do_handshake
match_hostname(self.getpeercert(), self.server_hostname)
File "/usr/local/lib/mailinabox/env/lib/python3.6/site-packages/idna_ssl.py", line 19, in patched_match_hostname
return real_match_hostname(cert, hostname)
File "/usr/lib/python3.6/ssl.py", line 327, in match_hostname
% (hostname, ', '.join(map(repr, dnsnames))))
ssl.CertificateError: hostname 'mta-sts.domain01.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'
Exception in callback None()
handle: <Handle cancelled>
Traceback (most recent call last):
File "/usr/lib/python3.6/asyncio/events.py", line 145, in _run
self._callback(*self._args)
File "/usr/lib/python3.6/asyncio/selector_events.py", line 721, in _read_ready
self._protocol.data_received(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 505, in data_received
ssldata, appdata = self._sslpipe.feed_ssldata(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 201, in feed_ssldata
self._sslobj.do_handshake()
File "/usr/lib/python3.6/ssl.py", line 694, in do_handshake
match_hostname(self.getpeercert(), self.server_hostname)
File "/usr/local/lib/mailinabox/env/lib/python3.6/site-packages/idna_ssl.py", line 19, in patched_match_hostname
return real_match_hostname(cert, hostname)
File "/usr/lib/python3.6/ssl.py", line 327, in match_hostname
% (hostname, ', '.join(map(repr, dnsnames))))
ssl.CertificateError: hostname 'mta-sts.domain02.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'
STS policy fetch for domain 'domain02.com' failed with error: Cannot connect to host mta-sts.domain02.com:443 ssl:True [CertificateError: ("hostname 'mta-sts.domain02.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'",)]
STS policy fetch for domain 'domain01.com' failed with error: Cannot connect to host mta-sts.domain01.com:443 ssl:True [CertificateError: ("hostname 'mta-sts.domain01.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'",)]
Exception in callback None()
handle: <Handle cancelled>
Traceback (most recent call last):
File "/usr/lib/python3.6/asyncio/events.py", line 145, in _run
self._callback(*self._args)
File "/usr/lib/python3.6/asyncio/selector_events.py", line 721, in _read_ready
self._protocol.data_received(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 505, in data_received
ssldata, appdata = self._sslpipe.feed_ssldata(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 201, in feed_ssldata
self._sslobj.do_handshake()
File "/usr/lib/python3.6/ssl.py", line 694, in do_handshake
match_hostname(self.getpeercert(), self.server_hostname)
File "/usr/local/lib/mailinabox/env/lib/python3.6/site-packages/idna_ssl.py", line 19, in patched_match_hostname
return real_match_hostname(cert, hostname)
File "/usr/lib/python3.6/ssl.py", line 327, in match_hostname
% (hostname, ', '.join(map(repr, dnsnames))))
ssl.CertificateError: hostname 'mta-sts.domain03.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'
STS policy fetch for domain 'domain03.com' failed with error: Cannot connect to host mta-sts.domain03.com:443 ssl:True [CertificateError: ("hostname 'mta-sts.domain03.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'",)]
Exception in callback None()
handle: <Handle cancelled>
Traceback (most recent call last):
File "/usr/lib/python3.6/asyncio/events.py", line 145, in _run
self._callback(*self._args)
File "/usr/lib/python3.6/asyncio/selector_events.py", line 721, in _read_ready
self._protocol.data_received(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 505, in data_received
ssldata, appdata = self._sslpipe.feed_ssldata(data)
File "/usr/lib/python3.6/asyncio/sslproto.py", line 201, in feed_ssldata
self._sslobj.do_handshake()
File "/usr/lib/python3.6/ssl.py", line 694, in do_handshake
match_hostname(self.getpeercert(), self.server_hostname)
File "/usr/local/lib/mailinabox/env/lib/python3.6/site-packages/idna_ssl.py", line 19, in patched_match_hostname
return real_match_hostname(cert, hostname)
File "/usr/lib/python3.6/ssl.py", line 327, in match_hostname
% (hostname, ', '.join(map(repr, dnsnames))))
ssl.CertificateError: hostname 'mta-sts.domain04.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'
STS policy fetch for domain 'domain04.com' failed with error: Cannot connect to host mta-sts.domain04.com:443 ssl:True [CertificateError: ("hostname 'mta-sts.domain04.com' doesn't match either of 'maindomain.com', 'mta-sts.maindomain.com', 'www.maindomain.com'",)]
System -- Previously:
=====================
✖ There are 2 software packages that can be updated.
[1 standard security update] ()
libmysqlclient20 (5.7.38-0ubuntu0.18.04.1)
System -- Currently:
====================
✓ System software is up to date.
maindomain.com -- Previously:
========================
✖ This domain's DNS MX record is incorrect. It is currently set to '1 ASPMX.L.GOOGLE.COM; 10 ALT3.ASPMX.L.GOOGLE.COM; 10 ALT4.ASPMX.L.GOOGLE.COM; 5 ALT1.ASPMX.L.GOOGLE.COM; 5 ALT2.ASPMX.L.GOOGLE.COM' but should be '10 post.maindomain.com'. Mail will not be delivered to this box. It may take several hours for public DNS to update after a change. This problem may result from other issues listed here.
maindomain.com -- Currently:
=======================
✓ Domain's email is directed to this domain. [maindomain.com ↦ 10 post.maindomain.com]
✖ MTA-STS policy is present but has unexpected settings. [{'mx': ['post.maindomain.com'], 'version': 'STSv1', 'mode': 'testing', 'max_age': 86400}]
Compare to the much more reader-friendly Status Checks Change Notice email I got this morning after finishing my MTA-STS setup on all my other domains [albeit, as per that other thread, still getting an ‘unexpected content’ error]:
System -- Previously:
=====================
✓ System software is up to date.
System -- Currently:
====================
✖ There are 8 software packages that can be updated.
[7 standard security updates] ()
sqlite3 (3.22.0-1ubuntu0.5)
libsqlite3-0 (3.22.0-1ubuntu0.5)
libssl-dev (1.1.1-1ubuntu2.1~18.04.17)
libssl1.1 (1.1.1-1ubuntu2.1~18.04.17)
networkd-dispatcher (1.7-0ubuntu3.5)
openssl (1.1.1-1ubuntu2.1~18.04.17)
libssl1.0.0 (1.0.2n-1ubuntu5.9)
domain01.com -- Previously:
=============================
✖ MTA-STS policy is missing: STSFetchResult.FETCH_ERROR
domain01.com -- Currently:
============================
✖ MTA-STS policy is present but has unexpected settings. [{'mx': ['post.maindomain.com'], 'version': 'STSv1', 'mode': 'testing', 'max_age': 86400}]
domain02.com -- Previously:
===========================
✖ MTA-STS policy is missing: STSFetchResult.FETCH_ERROR
domain02.com -- Currently:
==========================
✖ MTA-STS policy is present but has unexpected settings. [{'mx': ['post.maindomain.com'], 'version': 'STSv1', 'mode': 'testing', 'max_age': 86400}]
domain03.com -- Previously:
============================
✖ MTA-STS policy is missing: STSFetchResult.FETCH_ERROR
domain03.com -- Currently:
===========================
✖ MTA-STS policy is present but has unexpected settings. [{'mx': ['post.maindomain.com'], 'version': 'STSv1', 'mode': 'testing', 'max_age': 86400}]
domain04.com -- Previously:
=======================
✖ MTA-STS policy is missing: STSFetchResult.FETCH_ERROR
domain04.com -- Currently:
======================
✖ MTA-STS policy is present but has unexpected settings. [{'mx': ['post.maindomain.com'], 'version': 'STSv1', 'mode': 'testing', 'max_age': 86400}]
So, obviously, in the first example where I had the MTA-STS records set in my DNS but hadn’t yet completed the full setup [subdomains not setup yet, hence no policy doc, no SSL cert in place yet] the setup was so incomplete/broken that it actually caused an exception in the Python reporting script itself. Which wasn’t handled very gracefully.