AIX sendmail and tls

UNIX AIX
1

The situation

Version AIX7.1/8.14.4
 Compiled with: DNSMAP LDAPMAP LDAP_REFERRALS LOG MAP_REGEX MATCHGECOS
                MILTER MIME7TO8 MIME8TO7 NAMED_BIND NDBM NETINET NETINET6
                NETUNIX NEWDB NIS NISPLUS PIPELINING SCANF STARTTLS USERDB
                USE_LDAP_INIT XDEBUG

  openssl.base             1.0.1.513    CE    F    Open Secure Socket Layer

I configure sendmail for use tls

divert(0)dnl
VERSIONID(`Mustafar')
OSTYPE(aixsample)dnl
DOMAIN(`generic')dnl
define(`_X400_UUCP_')dnl
define(`_MASQUERADE_ENVELOPE_')dnl
define(`MASQUERADE_NAME')dnl
define(`confTRY_NULL_MX_LIST',`T')dnl
define(`LUSER_RELAY',`name_of_luser_relay')dnl
define(`DATABASE_MAP_TYPE',`dbm')dnl
define(`_CLASS_U_')dnl
define(`LOCAL_RELAY')dnl
define(`MAIL_HUB')dnl
TRUST_AUTH_MECH(`GSSAPI DIGEST-MD5')dnl
FEATURE(always_add_domain)dnl
FEATURE(access_db)dnl
MAILER(local)dnl
MAILER(smtp)dnl
MAILER(uucp)dnl
define(`SMART_HOST', `posta.server.local')
define(`confCACERT_PATH', `/etc/mail/certs')dnl
define(`confCACERT', `/etc/mail/certs/server.crt')dnl
define(`confSERVER_CERT', `/etc/mail/certs/ibmunix.server.crt')dnl
define(`confSERVER_KEY', `/etc/mail/certs/ibmunix.server.key')dnl
define(`confCLIENT_CERT', `/etc/mail/certs/ibmunix.server.crt')dnl
define(`confCLIENT_KEY', `/etc/mail/certs/ibmunix.server.key')dnl
define(`confRAND_FILE',`egd:/dev/random')dnl
define(`TLS_VERSION',`TLSV1')dnl
define(`confLOG_Level', `16')

I can receive mail from other server(all with tls)
but if try to send an email from this server

May  7 03:31:57 ibmunix mail:warn|warning sendmail[13303906]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1
May  7 03:31:57 ibmunix mail:warn|warning sendmail[13303906]: STARTTLS=client: 13303906:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:593:
May  7 03:31:57 ibmunix mail:notice sendmail[13303906]: ruleset=tls_server, arg1=SOFTWARE, relay=posta.server.local, reject=403 4.7.0 TLS handshake failed.

The other servers are configure for allow TLS only,no ssl3
but i try also with ssl3 server,same error.
Any suggestion?
Thanks

3

only one suggestion. did you try to connect to the SMTP server with openssl command from AIX?

aix# openssl s_client -connect server:465
4

Iuse port 25,i want tls not ssl

---------- Post updated at 11:44 PM ---------- Previous update was at 03:41 PM ----------

One thing i don't understand,here i read

Macros related to STARTTLS are: 


[*]${cert_issuer} holds the DN of the CA (the cert issuer).
[*]${cert_subject} holds the DN of the cert (called the cert subject).
[*]${cn_issuer} holds the CN of the CA (the cert issuer).
[*]${cn_subject} holds the CN of the cert (called the cert subject).
[*]${tls_version} the TLS/SSL version used for the connection, e.g., TLSv1,     TLSv1/SSLv3, SSLv3, SSLv2.
[*]${cipher} the cipher used for the connection, e.g., EDH-DSS-DES-CBC3-SHA,     EDH-RSA-DES-CBC-SHA, DES-CBC-MD5, DES-CBC3-SHA.

My question is,how to make those macro on .mc file?
I have tried those syntax,but doesn't work

 define(`macroTLS_VERSION',`TLSv1')dnl

and

 define(`confTLS_VERSION',`TLSv1')dnl

and

 define(`TLS_VERSION',`TLSv1')dnl

How to pass tlsv1 to sendmail?
Thanks