Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Mailer] Simplify the way TLS/SSL/STARTTLS work #33233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 19, 2019

Conversation

fabpot
Copy link
Member

@fabpot fabpot commented Aug 19, 2019

Q A
Branch? 4.4
Bug fix? no
New feature? yes
BC breaks? yes
Deprecations? no
Tests pass? yes
Fixed tickets n/a
License MIT
Doc PR -

The way TLS/SSL/STARTTLS is handled is not easy to understand. It's inherited from Swiftmailer and today, I've spent some time to see if we could improve it.

First, the current way: setEncryption() takes a string, either ssl or tls:

  • ssl: to enable TLS support on the connection
  • tls: to enable STARTTLS (upgrade the connection)

There is also a isTLS() method which is really confusing due to the fact that both configuration are about TLS anyway.

So, this PR changes things radically:

  • The setEncryption method and the encryption option on the DSN are gone.

  • TLS is used by default and you can disable it via disableTls(). Being secure by default is probably a good idea anyway (like using HTTPS by default instead of HTTP).

  • A new "protocol" SMTPS is supported now and is a way to say that you want TLS; so use smtps://localhost to set TLS instead of smtp://localhost?encryption=ssl. Note that using smtp://localhost:465 does the same. All third-party providers now supports both smtp and smtps protocol even if that does the exact same thing for them (TLS is always enabled).

  • The port is automatically determined based on the TLS setting (if not set explicitly). So 465 for TLS and falls back to 25.

  • There is no more way to enable STARTTLS. If you don't configure TLS on the connection and if the server supports STARTTLS, then we will enable it automatically.

Great document about all of this: https://www.fastmail.com/help/technical/ssltlsstarttls.html

@nicolas-grekas nicolas-grekas added this to the next milestone Aug 19, 2019
@fabpot fabpot force-pushed the mailer-encryption-simplification branch 4 times, most recently from cbef9dd to e123e1d Compare August 19, 2019 08:44
@fabpot fabpot changed the title [Mailer] Simplify the way TLS/SSL/StartTls work [Mailer] Simplify the way TLS/SSL/STARTTLS work Aug 19, 2019
@fabpot fabpot force-pushed the mailer-encryption-simplification branch from e123e1d to 1042a3c Compare August 19, 2019 09:01
@fabpot fabpot force-pushed the mailer-encryption-simplification branch from 1042a3c to 5b8c467 Compare August 19, 2019 09:19
@fabpot
Copy link
Member Author

fabpot commented Aug 19, 2019

Tests are fixed now (deps high will be fixed when merging 4.4 to master).

fabpot added a commit that referenced this pull request Aug 19, 2019
This PR was merged into the 4.4 branch.

Discussion
----------

[Mailer] Simplify the way TLS/SSL/STARTTLS work

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | yes
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | -

The way TLS/SSL/STARTTLS is handled is not easy to understand. It's inherited from Swiftmailer and today, I've spent some time to see if we could improve it.

First, the current way: `setEncryption()` takes a string, either `ssl` or `tls`:

 * `ssl`: to enable TLS support on the connection
 * `tls`: to enable `STARTTLS` (upgrade the connection)

There is also a `isTLS()` method which is really confusing due to the fact that both configuration are about TLS anyway.

So, this PR changes things radically:

 * The `setEncryption` method and the `encryption` option on the DSN are gone.

 * TLS is used by default and you can disable it via `disableTls()`. Being secure by default is probably a good idea anyway (like using HTTPS by default instead of HTTP).

 * A new "protocol" SMTPS is supported now and is a way to say that you want TLS; so use `smtps://localhost` to set TLS instead of `smtp://localhost?encryption=ssl`. Note that using `smtp://localhost:465` does the same. All third-party providers now supports both `smtp` and `smtps` protocol even if that does the exact same thing for them (TLS is always enabled).

 * The port is automatically determined based on the TLS setting (if not set explicitly). So 465 for TLS and falls back to 25.

 * There is no more way to enable `STARTTLS`. If you don't configure TLS on the connection and if the server supports `STARTTLS`, then we will enable it automatically.

Great document about all of this: https://www.fastmail.com/help/technical/ssltlsstarttls.html

Commits
-------

5b8c467 [Mailer] simplified the way TLS/SSL/StartTls work
@fabpot fabpot merged commit 5b8c467 into symfony:4.4 Aug 19, 2019
@fabpot fabpot deleted the mailer-encryption-simplification branch September 6, 2019 10:41
@nicolas-grekas nicolas-grekas modified the milestones: next, 4.4 Oct 27, 2019
This was referenced Nov 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants