Password reset emails not being sent with new Debian Buster image

[misaugstad]

Brief description of problem/feature

After upgrading our Dockerfile from Stretch to Buster, we are getting the following error when trying to send password reset emails (even on dev env):

javax.mail.MessagingException: Could not convert socket to TLS;
  nested exception is:
	javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)

We had had this issue just on the prod servers in the past (not our dev env), and @mechanicjay realized that it was an issue of the base image being out of date and missing some important security updates. It doesn't seem like it's quite the same issue here. I just ran an apt upgrade to make sure that we were all up to date, and I'm still having this issue. Need to dive deeper!

[misaugstad]

The issue has to do with our outdated libraries not using a better (and newer) security protocol, and their older protocol is generally configured to not be accepted.

We can fix this in the dev env by removing TLSv1 from the jdk.tls.disabledAlgorithms list in the java.security file. But this doesn't extend to our live servers because there's a proxy server between between our application and the internet that doesn't allow the weaker connections (according to @yhtill). And it's not clear that this is something that we would want to do anyway given the security vulnerabilities...

So maybe there's a different email sending library that is compatible with the rest of our back end code (I have my doubts). Or it's possible that password reset emails just won't work until we upgrade our back end libraries...

[jonfroehlich]

Thanks Mikey. I'm curious what the expected time work load would be on upgrading our backend libraries. I know you tried doing this a few years ago and stopped due to time effort and complexity... we can discuss on Slack.

[misaugstad]

Turns out that @yhtill was secretly working some magic to resolve our issues by using the department's SMTP relay! 🙌