Seems to be a handshake failure in the SSL stuff
Yes, that does seem to be the case.
With your implicit permission - I tried a test connection to your mail server from a Hikvision NVR running firmware 3.4.91
Email settings were SSL enabled, port 465, authentication required.
The test connection failed, with this showing in the NVR console :
Code:
Adjust date/time from RTC.
HostSetDateTime 2017-10-4 8:55:25
[root@dvrdvs /root] # smtp_connect getsockopt failed:: Invalid argument
Connect to SMTP server ok.
SSL_connect OK!!
want 220, received not expected response .
Connect to SMTP server ok.
select timeout or error!!
########init_mail_sender_TLS failed
The NVR is supporting SSLv3, which is good.
Looking at the network capture, the mail server response to the Client Hello gives a 'Handshake failure (40)'.
A quick Google search on that suggests the mail server may require the 'Server Name Indication' passed in the Client Hello, which is not included in the captured dialogue.
It's not a topic I'm familiar with, however this appears to describe the requirement :
Server Name Indication - Wikipedia
However - I did wonder if this may be a consequence of me using the server IP address as opposed to the target FQDN (Fully Qualified Domain Name) so I also tried it with the reverse DNS value - which may not be your required target FQDN assuming multiple mail setvers are hosted on that address (though it looks the same as your screenshot).
This gave the same result, and I could see no server name embedded as part of the Client Hello.
According to the Wikipedia article :
In 2004, a patch for adding TLS/SNI into
OpenSSL was created by the EdelKey project.
[5] In 2006, this patch was then ported to the development branch of OpenSSL, and in 2007 it was back-ported to OpenSSL 0.9.8 (first released in 0.9.8f
[6]).
And from the openssl library in the NVR :
OpenSSL 1.0.1l 15 Jan 2015
built on: Wed May 13 15:50:01 2015
platform: linux-armv4
SSLv3 part of OpenSSL 1.0.1l 15 Jan 2015
Suggesting that the code is new enough to implement that feature.
But, I suppose, having the SNI feature doesn'r necessarily mean that the NVR firmware makes use of it.
I'm not sure where you go from here - except maybe to see if any tech support (Hikvision - unlikely, but you never know) or the hosting provider, might be able to comment.
