Mailgate 500 server error - help needed

I’m moving an RT instance from one server to another (a VPS), and mailgate won’t behave.

It works like a charm on the old server and has for years (since 2011 at least)

On the new server I get:

rene@vk1 103 $  /usr/bin/rt-mailgate --debug --no-verify-ssl --queue Questions --action correspond --extension ticket --url https://booking.venicekayak.com/ < test.eml 
/usr/bin/rt-mailgate: temp file is '/tmp/XqPJJD6yCR/KoUbq2NY_a'
/usr/bin/rt-mailgate: connecting to https://booking.venicekayak.com//REST/1.0/NoAuth/mail-gateway
HTTP request failed: 500 Server closed connection without sending any data back. Your webserver logs may have more information or there may be a network problem.

/usr/bin/rt-mailgate: undefined server error

There is nothing whatsoever in the server logs. The web server is on the same host.

The server is there and responds:

rene@vk1 102 $ POST https://booking.venicekayak.com//REST/1.0/NoAuth/mail-gateway
Please enter content (application/x-www-form-urlencoded) to be POSTed:
not ok - Couldn't parse or find sender's address

And this leaves a nice trail on the server logs.

Both servers are running Debian 9.8

I have tried to enable various types of debug:

rene@vk1 102 $ strace -e trace=socket,select,listen,connect perl -MIO::Socket::SSL=debug4 /usr/bin/rt-mailgate --debug --no-verify-ssl --queue Questions --action correspond --extension ticket --url https://booking.venicekayak.com/ < test.eml 
/usr/bin/rt-mailgate: temp file is '/tmp/pm5hqhNMgj/O4j99WctwI'
/usr/bin/rt-mailgate: connecting to https://booking.venicekayak.com//REST/1.0/NoAuth/mail-gateway
DEBUG: .../IO/Socket/SSL.pm:2853: new ctx 94910489099472
socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 3
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC, IPPROTO_TCP) = 3
DEBUG: .../IO/Socket/SSL.pm:692: socket not yet connected
connect(3, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("80.211.159.137")}, 16) = -1 EINPROGRESS (Operation now in progress)
select(8, NULL, [3], [3], {tv_sec=180, tv_usec=0}) = 1 (left {tv_sec=179, tv_usec=999997})
DEBUG: .../IO/Socket/SSL.pm:694: socket connected
DEBUG: .../IO/Socket/SSL.pm:717: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:750: using SNI with hostname booking.venicekayak.com
DEBUG: .../IO/Socket/SSL.pm:785: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:806: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:819: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:2754: did not get stapled OCSP response
DEBUG: .../IO/Socket/SSL.pm:822: done Net::SSLeay::connect -> 1
DEBUG: .../IO/Socket/SSL.pm:877: ssl handshake done
select(8, [3], [3], NULL, {tv_sec=180, tv_usec=0}) = 2 (in [3], out [3], left {tv_sec=179, tv_usec=999996})
select(8, [3], NULL, NULL, {tv_sec=180, tv_usec=0}) = 1 (in [3], left {tv_sec=179, tv_usec=999996})
DEBUG: .../IO/Socket/SSL.pm:2875: free ctx 94910489099472 open=94910489099472
DEBUG: .../IO/Socket/SSL.pm:2879: free ctx 94910489099472 callback
DEBUG: .../IO/Socket/SSL.pm:2886: OK free ctx 94910489099472
HTTP request failed: 500 Server closed connection without sending any data back. Your webserver logs may have more information or there may be a network problem.

/usr/bin/rt-mailgate: undefined server error
+++ exited with 75 +++

It doesn’t seem to be the server certificate.

If I give access to my laptop (also debian) I can run mailgate on that and it works remotely. It doesn’t work on the server locally.

Any ideas? I’m not getting anywhere.

It has something to do with SSL because if I move the RT instance to http (not https) it works.

I use Let’s Encrypt certificates and they give not problems elsewhere.

The problems affects not only rt-mailgate but also rt and my perl programs using RT::Client::REST.

Wget, curl, lwp-request etc works. The REST interface on the server works.

The problems is that the RT perl clients don’t even connect to the server, and there is no trace of any activity on the apache logs.

Apparently this is an LWP issue when apache uses TLSv1.3 for SSL. If I add this to my apache config it works.

SSLProtocol all -SSLv3 -TLSv1.3

My old server uses TLSv1.2.

1 Like