Mail::Sender script fails upon Linux (and Perl) update

[dneill8]

A script that was operational for every 2 weeks for 2 years failed when I moved it to a ubuntu 12.04 LTS system Linux 3.8.0-34-generic Perl (v5.14.2) The modules in use are the following - I've included the version numbers for those I think might be involved in the problem:

use warnings;
use DBI;
use Text::CSV_XS;
use Text::CSV;
use Net::SMTP::SSL;    1.01
use MIME::Base64;
use File::Spec;
use LWP::MediaTypes;    6.01
use Date::Calc qw(:all);
use Mail::Sender;        0.8.22

The mail server being used is our Exchange Server, via a local IP address. I think the change may be a more-enforeced requirement for certificates OR I need to install the server's certificate on this new Linux system. The operative part of the script that is throwing the error is:

open my $DEBUG, ">> //root/FAVOR_Data_Reports_scripts/debug_file_gen_a
+nd_mail_adv_reports.txt" or die "Can't open the debug file: $!\n";
     ref ($sender = new Mail::Sender({from => '[e-mail]',smt
+p
     => '10.11.74.18'})) or die "$Mail::Sender::Error\n";
     (ref ($sender->MailFile(
        {to =>'[e-mail]', subject => "FY 2012-13 - All Open 
+EOCs - Advocates Report for ".$report_date,
        msg => "\nAttached is the FAVOR Advocates Report for All Open 
+EOCS - 2012-2013",
        debug => $DEBUG,
        debug_level => 4,
       file => $advocates_report_filename
      }))
      and print "Mail sent OK."
     )
     or die "$Mail::Sender::Error\n";

The error this produces is:

IO::Socket::SSL->start_SSL failed: SSL connect attempt failed with unk
+nown errorerror:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:cer
+tificate verify failed

The debug file created when the script is run shows:

>> 220 mail.madeup.org Microsoft ESMTP MAIL Service ready at Sat, 28 D
+ec 2013 13:28:21 -0500
<< EHLO localhost
>> 250-mail.madeup.org Hello [10.11.74.25]
>> 250-SIZE 36700160
>> 250-PIPELINING
>> 250-DSN
>> 250-ENHANCEDSTATUSCODES
>> 250-STARTTLS
>> 250-AUTH NTLM
>> 250-8BITMIME
>> 250-BINARYMIME
>> 250 CHUNKING
<< STARTTLS
>> 220 2.0.0 SMTP server ready

I looked at the log on the Exchanger Server and this is what's going on on that end - Exchange sends a certificate verification and I'm not sure what to do with that (the line numbers on the left were put inserted so we can use references):

  1 2014-01-02T10:24:35.047Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,0,10.11.74.18:25,10.11.74.25:34156,+,,
  2 2014-01-02T10:24:35.047Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,1,10.11.74.18:25,10.11.74.25:34156,*,SMTPSubmit SMTPAcceptAnySender 
+SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session 
+Permissions
  3 2014-01-02T10:24:35.047Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,2,10.11.74.18:25,10.11.74.25:34156,>,"220 mail.somedomain.org Micros
+oft ESMTP MAIL Service ready at Thu, 2 Jan 2014 05:24:34 -0500",
  4 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,3,10.11.74.18:25,10.11.74.25:34156,<,EHLO localhost,
  5 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,4,10.11.74.18:25,10.11.74.25:34156,>,250-mail.somedomain.org Hello [
+10.11.74.25],
  6 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,5,10.11.74.18:25,10.11.74.25:34156,>,250-SIZE 36700160,
  7 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,6,10.11.74.18:25,10.11.74.25:34156,>,250-PIPELINING,
  8 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,7,10.11.74.18:25,10.11.74.25:34156,>,250-DSN,
  9 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,8,10.11.74.18:25,10.11.74.25:34156,>,250-ENHANCEDSTATUSCODES,
 10 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,9,10.11.74.18:25,10.11.74.25:34156,>,250-STARTTLS,
 11 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,10,10.11.74.18:25,10.11.74.25:34156,>,250-AUTH NTLM,
 12 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,11,10.11.74.18:25,10.11.74.25:34156,>,250-8BITMIME,
 13 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,12,10.11.74.18:25,10.11.74.25:34156,>,250-BINARYMIME,
 14 2014-01-02T10:24:35.094Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,13,10.11.74.18:25,10.11.74.25:34156,>,250 CHUNKING,
 15 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,14,10.11.74.18:25,10.11.74.25:34156,<,STARTTLS,
 16 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,15,10.11.74.18:25,10.11.74.25:34156,>,220 2.0.0 SMTP server ready,
 17 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,16,10.11.74.18:25,10.11.74.25:34156,*,,Sending certificate
 18 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,17,10.11.74.18:25,10.11.74.25:34156,*,"CN=webmail.somedomain.org, OU
+=Domain Control Validated",Certificate subject
 19 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,18,10.11.74.18:25,10.11.74.25:34156,*,"SERIALNUMBER=07969287, CN=Go 
+Daddy Secure Certification Authority, OU=http://certificates.godaddy.
+com/repository, O=""GoDaddy.c    om, Inc."", L=Scottsdale, S=Arizona,
+ C=US",Certificate issuer name
 20 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,19,10.11.74.18:25,10.11.74.25:34156,*,4B7D04F464AD8A,Certificate ser
+ial number
 21 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,20,10.11.74.18:25,10.11.74.25:34156,*,C3B8E4FF095318BBE93F4D26ACA11E
[phone],Certificate thumbprint
 22 2014-01-02T10:24:35.140Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,21,10.11.74.18:25,10.11.74.25:34156,*,webmail.somedomain.org;www.web
+mail.somedomain.org;mail.somedomain.org,Certificate alternate names
 23 2014-01-02T10:24:35.281Z,EXCHSERVER\Relay Receive,08D0C0F3026261AE
+,22,10.11.74.18:25,10.11.74.25:34156,-,,Local

[wazat]

This looks like one of those problems where it is easy to fall down a rabbit hole.

I don't have experience with this problem, so be careful I don't send you down one of those rabbit holes.

$sender = new Mail::Sender({from => '[e-mail]',smtp
     => '10.11.74.18'})

For exploration purposes, reading IO::Socket::SSL docs it looks like you might be able to disable the client side from verifying the certificate. If that hides the problem then that suggests the problem is in the certificate verification.

SSL_verify_mode => SSL_VERIFY_NONE

From the server log line 22, it looks like the certificate is for "webmail.somedomain.org", while your script is connecting via IP address. Does it make a difference if you specify "webmail.somedomain.org" instead of the IP address?

A quick google for godaddy CA openSSL returns some results that may be apropos, or perhaps just a very deep rabbit whole.

[dneill8]

Your observations on rabbit holes are very much appreciated. I'll check out what you recommend and post back.

[noxxi]

It's a known bug in Mail::Sender, see there work a workaround: RT#85438

[dneill8]

Sorry folks - in the above madeup.org and somedomain.org should be the same value - I obscured in two different steps and forgot to make the second the same - it's all happening in the same domain. TIA.