# SMTP Email sender configuration errors

**URL:** <https://forum.opensearch.org/t/smtp-email-sender-configuration-errors/21006>\
**Category:** OpenSearch Dashboards\
**Tags:** notifications\
**Created:** [August 28, 2024, 8:28am UTC](https://forum.opensearch.org/t/smtp-email-sender-configuration-errors/21006 "2024-08-28T08:28:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![inkerinmaa](https://avatars.discourse-cdn.com/v4/letter/i/ac91a4/32.png) [@inkerinmaa](https://forum.opensearch.org/u/inkerinmaa)\
**Post date:** [August 28, 2024, 8:28am UTC](https://forum.opensearch.org/t/smtp-email-sender-configuration-errors/21006/1 "2024-08-28T08:28:54Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.15

**Describe the issue** :  
Hello. Opensearch 2.15 3-node docker cluster. I want to send an email notification using smtp server with self-signed certificate (corporate CA). I created smtp sender, SSL/TLS, port 587. Added credentials  
/usr/share/opensearch/bin/opensearch-keystore add opensearch.notifications.core.email.corpsmtp.username (same with .password).  
Got an error with SSL/TLS handshake. Added corp ca.crt and intermediate\_ca.crt to keystore  
keytool -import -noprompt -trustcacerts -alias rwl\_ca -file ca.crt -keystore $JAVA\_HOME/lib/security/cacerts -storepass changeit (same for intermediate\_ca.crt). All these steps performed on all 3 nodes. The stop containers, start. Getting 503 error:  
{“status\_code”:“503”,“status\_text”:“sendEmail Error, status:Couldn’t connect to host, port: smtp.rwlk.cz, 587; timeout -1”}}],“delivery\_status”:{“status\_code”:“503”,“status\_text”:“sendEmail Error, status:Couldn’t connect to host, port: smtp.rwlk.cz, 587; timeout -1”}}]}  
For test purposes, I activated unsecured smtp on 25 port (though, auth required anyway). The same error.  
Also, I am able to send notification emails using public smtp servers, no problems. Also, from the server opensearch is running on I am able to send emails with my corporate smtp without problems just using simple python script with smtplib. I disable hostname check context.check\_hostname = False and disable validation with context.verify\_mode = ssl.CERT\_NONE.  
Questions:

1. Why I am getting 503 even after I added custom ca and intermediate ca to keystore? Any specific way to do this?
2. Is there a way to disable smtp ssl certificate validation for such a cases when we intend to use self-signed ca?
3. Why it doesn’t work and I am getting error even when I configured sender as non-encrypted with port 25?

Thank you

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![merlinz01](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@merlinz01](https://forum.opensearch.org/u/merlinz01)\
**Post date:** [August 28, 2024, 4:45pm UTC](https://forum.opensearch.org/t/smtp-email-sender-configuration-errors/21006/2 "2024-08-28T16:45:21Z")

</div>

Can you verify that you can ping the SMTP server from the docker container or the host machine?

---

<div class="post-metadata">

**Author:** ![inkerinmaa](https://avatars.discourse-cdn.com/v4/letter/i/ac91a4/32.png) [@inkerinmaa](https://forum.opensearch.org/u/inkerinmaa)\
**Post date:** [August 29, 2024, 1:57pm UTC](https://forum.opensearch.org/t/smtp-email-sender-configuration-errors/21006/3 "2024-08-29T13:57:15Z")

</div>

Thanks, you was right.  
So, just for anyone who will be doing the same:  
I added our corporate dns (as root in docker container): `echo "nameserver 10.10.10.21" >> /etc/resolv.conf`  
`getent hosts smtp.rwlk.cz - to check that name resolves`  
Added our ca.crt and intermediate.crt to trusted store:`keytool -import -noprompt -trustcacerts -alias ca -file ca.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit`  
Added username and password  
`/usr/share/opensearch/bin/opensearch-keystore add opensearch.notifications.core.email.monitoring.username`  
`/usr/share/opensearch/bin/opensearch-keystore add opensearch.notifications.core.email.monitoring.password`  
Reload secure settings `curl -X POST "https://localhost:9200/_nodes/reload_secure_settings" --insecure -u admin:admin`