SMTP Email sender configuration errors

OpenSearch Dashboards
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.15

Describe the issue:
Hello. Opensearch 2.15 3-node docker cluster. I want to send an email notification using smtp server with self-signed certificate (corporate CA). I created smtp sender, SSL/TLS, port 587. Added credentials
/usr/share/opensearch/bin/opensearch-keystore add opensearch.notifications.core.email.corpsmtp.username (same with .password).
Got an error with SSL/TLS handshake. Added corp ca.crt and intermediate_ca.crt to keystore
keytool -import -noprompt -trustcacerts -alias rwl_ca -file ca.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit (same for intermediate_ca.crt). All these steps performed on all 3 nodes. The stop containers, start. Getting 503 error:
{“status_code”:“503”,“status_text”:“sendEmail Error, status:Couldn’t connect to host, port: smtp.rwlk.cz, 587; timeout -1”}}],“delivery_status”:{“status_code”:“503”,“status_text”:“sendEmail Error, status:Couldn’t connect to host, port: smtp.rwlk.cz, 587; timeout -1”}}]}
For test purposes, I activated unsecured smtp on 25 port (though, auth required anyway). The same error.
Also, I am able to send notification emails using public smtp servers, no problems. Also, from the server opensearch is running on I am able to send emails with my corporate smtp without problems just using simple python script with smtplib. I disable hostname check context.check_hostname = False and disable validation with context.verify_mode = ssl.CERT_NONE.
Questions:

  1. Why I am getting 503 even after I added custom ca and intermediate ca to keystore? Any specific way to do this?
  2. Is there a way to disable smtp ssl certificate validation for such a cases when we intend to use self-signed ca?
  3. Why it doesn’t work and I am getting error even when I configured sender as non-encrypted with port 25?

Thank you

Configuration:

Relevant Logs or Screenshots:

2

Can you verify that you can ping the SMTP server from the docker container or the host machine?

3

Thanks, you was right.
So, just for anyone who will be doing the same:
I added our corporate dns (as root in docker container): echo "nameserver 10.10.10.21" >> /etc/resolv.conf
getent hosts smtp.rwlk.cz - to check that name resolves
Added our ca.crt and intermediate.crt to trusted store:keytool -import -noprompt -trustcacerts -alias ca -file ca.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
Added username and password
/usr/share/opensearch/bin/opensearch-keystore add opensearch.notifications.core.email.monitoring.username
/usr/share/opensearch/bin/opensearch-keystore add opensearch.notifications.core.email.monitoring.password
Reload secure settings curl -X POST "https://localhost:9200/_nodes/reload_secure_settings" --insecure -u admin:admin

3 Likes