Certificate presented by smtp.talktalk.net is invalid or corrupted. Error Code: -8182

[Tobermory]

So I changed the settings in my e-mail program, as instructed by ‘TalkTalk’. “Server name” : smtp.talktalk.net (as before). “Port”: 587 (previously 25). “Use secure connection”: TLS, if available (previously No).

Now, when I attempt to upload e-mails from my program to the ‘TalkTalk’ server, my program reports the following error: “Alert! Could not establish an encrypted connection because certificate presented by smtp.talktalk.net is invalid or corrupted. Error Code: -8182”

I am still able to download e-mails successfully from the ‘TalkTalk’ server.

I would be grateful for suggestions as to how I can resolve my problem. Rather than having to wait for the children, who create the TT s/w, to recognise that there is now an issue and then correct it. [ I can imagine the meeting those kids had. What shall we do today? Well, the e-mail server has been functioning reliably for a while now. So let’s install some different s/w and break it. ]

I tried to raise the problem, in a ‘TT’ “chat” with John. Spent over half an hour, providing security answers, explaining the situation to John and answering his questions. Then the “chat” link dropped and all that had gone before was lost.

[Ady-TalkTalk]

Hi Tobermory, Gondola has been trying to help why the resistance? What mail client are you using? 

Ady

[Gondola]

Switching off IMAP and POP3 access for individual mailboxes to protect users for their own failure to use secure mail despite repeated notifications from TalkTalk is NOT a change to the email software.

YOU have insecure software. Get it upgraded or switched. That's the truth. Discussion ended.

[Tobermory]

I have avoided responding to your previous personal, derogatory remarks, Gondola, and will continue to do so (I suspect that these are motivated by the difficulty to argue rationally with the truth).

What I will note is that your statement that “TalkTalk has not changed any software its end” is simply wrong and therefore misleading (to be euphemistic) and should be retracted. If the TalkTalk server software had not been changed clients would not have lost access to the e-mail facility from their devices. Fact. No doubt about this.

We can have a discussion about the security or otherwise of the current connections available to the TalkTalk server in a separate post, more relevant to the topic. The nub of which will be the implication of what you term “out of date” software continuing to be able to download e-mails from the TT server.

[Tobermory]

You could change to an ISP, which does not allow children to replace functioning server software with new code that requires clients to reconfigure their systems. An ISP which has technical support staff, who work hard to resolve any problems and who realise that the clients provide the income that pays their salaries, and conduct themselves accordingly. This forum is now flooded with posts from customers experiencing problems with the new server software. And nowhere do I see any apology from TalkTalk for the inconvenience caused.

[Gondola]

TalkTalk does not support MD5 encryption and has not done so for some considerable time and SHA1 is deprecated and not used.

MD5 encryption

Bite the bullet and agree that your email software is way past its retirement date. Whatever it is called. Obviously a big secret.

[Tobermory]

As stated below in my previous post: “I have presently enabled all twenty six of the Cipher options available and enabled all SSL and TLS operation options.”

Here are screen shots of the TLS related cipher tabs:

TLS cipher tabs

[Gondola]

Lots of words but absolutely nothing answering my question.

So, are any of the ciphers you've enabled in the TLS 1.2 cipher suite? And have you disabled all TLS 1.1 and TLS 1.0 and SSL ciphers?

Or putting it simply, does your unnamed email software support TLS 1.2 encryption or not?

[Tobermory]

I have presently enabled all twenty six of the Cipher options available and enabled all SSL and TLS operation options. As I stated, I mentioned “56-bit RC4 encryption with RSA and a SHA1 MAC (export)” as an example of one of them. Rather than list all twenty six here.

I could pipe e-mails to the ‘TT’ server without problem on Wednesday. So my s/w was not “way out of date” 3 days ago, Gondola. Now, when I attempt to upload e-mails to the ‘TalkTalk’ server, my e-mail program reports the error: “Alert! Could not establish an encrypted connection because certificate presented by smtp.talktalk.net is invalid or corrupted. Error Code: -8182”. The ‘TT’ e-mail server s/w is the origin of this problem, not something on my end of the link. Otherwise there would not be the current profusion of posts on this forum from people experiencing similar problems. Though I accept that it may be possible to change the configuration of my s/w to accommodate the revisions to ‘TT’s server s/w. - ‘TT’ expect those of us who are the source of their income to accommodate shortcomings in modifications to their server s/w?

What I need is a solution to the failure. (A failure imposed by changes to the ‘TT’ server s/w. Not by my e-mail program.) I asked about what version of SSL and Cipher Suite the ‘TT’ server uses as a potential path to finding such. But, obviously, I am quite happy to entertain any better suggestions.

[Gondola]

You haven't said what your email program is.

But if you're only using 56bit SHA1 deprecated ciphers it's obviously way out of date.

[Tobermory]

I can download e-mails from the ‘TT’ server in to my e-mail program, thank you, Gondola. As I recounted above, when I attempt to upload e-mails from my program to the ‘TalkTalk’ server, my program reports the error: “Alert! Could not establish an encrypted connection because certificate presented by smtp.talktalk.net is invalid or corrupted. Error Code: -8182”. That is what my e-mail program returns, so that is what I state here.

Which implies that there is indeed a problem with the SMTP server certificate or how it is passed to my program. I have not received an advisory message from ‘TT’, either of the type you describe or any other. But if ‘TT’ support have blocked my access to the e-mail server then it does need to be restored. Although it seems strange that if blocked access is the problem my e-mail program is generating an error message about an invalid or corrupted certificate being presented by the server? - When I disable encryption and attempt to upload an e-mail to the ‘TT’ server, then the error message displayed is: “You cannot connect to smtp.talktalk.net because SSL is disabled”

I can still access my ‘TT’ e-mails through the browser based “Webmail” and I regularly use this to see what is waiting for me on the ‘TT’ e-mail server. The features of “Webmail” are so limited though (e.g. the search and folder structure “facilities”). And a major flaw is that the e-mails are stored (or lost) at ‘TT’s discretion. With my e-mail program they are where I can back them up, as I regularly do.

I appreciate your response, suunto. I do not appear to have quite the same server authentication options as you . My e-mail program allows a variety of “SSL: Edit Ciphers” to be selected or disabled. For example “56-bit RC4 encryption with RSA and a SHA1 MAC (export)”. So it might be pertinent what version of SSL and Cipher Suite the ‘TT’ server uses for an ingoing connection?

On Wednesday I could send e-mails through the ‘TT’ server from my e-mails program. Since I have changed the Port number and enabled encryption, as requested by ‘TT’ and as I describe above, this facility fails and the error above is reported. So what is ‘TT’s thinking here? Let’s break a reliably working facility, because we have nothing better to do and it will then highlight how poor both the knowledge and service of our “Technical Support” is. And it will upset our subscribers of over a decade, to the extent where they are likely to seek another ISP. And we lose more revenue. Smart.

[Gondola]

Nothing wrong with the SMTP server certificate or its signing and accepting the certificate as is will work. The outgoing server does require authentication with the email account password.

What exactly is the email software you're using?

If you saw the message from TalkTalk advising "Our records show that you are still accessing your email using unencrypted email settings, because of this you will no longer be able to receive or send emails via this email app or software" then the email address receiving that notification has been limited to webmail only access as a last resort action by TalkTalk to stop the use of insecure email.

TalkTalk Mail webmail is secure by design using an up to date Internet browser.

Select here:  Sign in to TalkTalk Mail

Enter your full TalkTalk Mail email address and password, select Sign in.

You will be able to get email access restored to email apps or software including mail collection services so long as you're ready to use up to date and secure email settings for all the ways you view emails. We can advise on device and software compatibility and provide customer setup guides. Just let us know each mail collection service, each device, its operating system and email software including version that are in current use.

For a definitive check of settings take screenshots of the incoming and outgoing server settings, image edit to obscure the first part of the email address and upload here using the Camera icon (desktop browser) or Picture icon (mobile browser) above this reply area.

When you confirm the secure settings are ready I can request TalkTalk Support to restore full access. TalkTalk Support will respond here and access will be restored usually within a couple of working days.

Prepare for TalkTalk Support - include in the Community Profile (not in these public posts):

 Email account holder name

 Scroll down to Private notes to add the email address(es)
and TalkTalk or MailPlus customer account number

 Check and Save changes

Select here:  Update your profile

The TalkTalk Mail Support Hub is your go to resource for information, guides and Community support for TalkTalk Consumer home broadband and MailPlus subscribers.

Select here:
 TalkTalk Mail Support

TalkTalk Mail help
 Using TalkTalk Mail

 Email settings and device setup guides for TalkTalk Mail

 About TalkTalk Mail Plus

[suunto]

Hi, i had the same issue which is how i found your post. i'm using outlook

what worked for me was click, tools, accounts, click the email then properties then on teh tabs at the top click servers and at the bottom click on the my server requires authentication