[Answered ]-EOF occurred in violation of protocol (_ssl.c:1125) on python:3.8-slim-buster

by

0👍

✅

So in short, it’s very likely your mail server only supports TLS 1.1 or even only TLS 1.0 and the slim-buster image no longer has support for those protocols.

Going back to 3.7-alpine (which is known working combination) or an older ubuntu/debian version which still supports those protocols will allow you to send mail again.

Then you should upgrade your mail server, cause both TLS 1.0 and TLS 1.1 should have died long ago.

Edit:

Another way to test your mailserver is to use openssl’s s_client command:

openssl s_client -no_tls1 -no_tls1_1 -no_tls1_2 -connect your.mail.host:port

This will likely fail. Then remove a -no_tls flag till it starts working and you know the highest protocol it supports.

Note: -no_tls1_2 is only supported on openssl versions that support TLSv1.3

👤user1600649

1👍

The fix was to use the originally working os python:3.7-alpine which seems to be able to send email however the smtp server requires it (still not sure what tls version it forces but I assume its tls 1.2).

Also wanted to add the reason we tried using python:3.8-slim-buster is because cookiecutter uses it, it’s recommended by https://pythonspeed.com/articles/base-image-python-docker-images/ and the latest versions of the cryptography module (3.4+ https://cryptography.io/en/latest/changelog.html#v3-4) recommend using a modern version of pip (else you have to install rust to compile cryptography). Cryptography module is required by django-allauth (by way of pyjwt).

To use modern versions of django-allauth (which I think was required by django 3.1) I pinned the cryptography module to the latest pre-rust

django-allauth==0.44.0  # https://github.com/pennersr/django-allauth
cryptography==3.3.2 # https://github.com/pyca/cryptography
👤Harry Moreno

Leave a comment