From fbfc446e351335d726fc6452fdc918f1b4e1e518 Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Wed, 28 Oct 2026 14:51:29 +0100 Subject: [PATCH] Verify SMTP server hostname on SSL/TLS connections (S5527) commons-email only checks the certificate chain by default, so any valid certificate was accepted regardless of host. Enable server identity checking wherever SSL or STARTTLS is configured. Signed-off-by: Nico Piel --- .../mirth/connect/connectors/smtp/DefaultSmtpConfiguration.java | 2 ++ .../server/controllers/DefaultConfigurationController.java | 2 ++ .../com/mirth/connect/server/util/ServerSMTPConnection.java | 2 ++ 3 files changed, 6 insertions(+) diff --git a/server/src/main/java/com/mirth/connect/connectors/smtp/DefaultSmtpConfiguration.java b/server/src/main/java/com/mirth/connect/connectors/smtp/DefaultSmtpConfiguration.java index 839921d2f6..ab7621f958 100644 --- a/server/src/main/java/com/mirth/connect/connectors/smtp/DefaultSmtpConfiguration.java +++ b/server/src/main/java/com/mirth/connect/connectors/smtp/DefaultSmtpConfiguration.java @@ -39,8 +39,10 @@ public void configureEncryption(ConnectorProperties connectorProperties, Email e if ("SSL".equalsIgnoreCase(props.getEncryption())) { email.setSSLOnConnect(true); email.setSslSmtpPort(props.getSmtpPort()); + email.setSSLCheckServerIdentity(true); } else if ("TLS".equalsIgnoreCase(props.getEncryption())) { email.setStartTLSEnabled(true); + email.setSSLCheckServerIdentity(true); } } diff --git a/server/src/main/java/com/mirth/connect/server/controllers/DefaultConfigurationController.java b/server/src/main/java/com/mirth/connect/server/controllers/DefaultConfigurationController.java index bfee2eddbf..8f8589a567 100644 --- a/server/src/main/java/com/mirth/connect/server/controllers/DefaultConfigurationController.java +++ b/server/src/main/java/com/mirth/connect/server/controllers/DefaultConfigurationController.java @@ -1660,8 +1660,10 @@ public ConnectionTestResponse sendTestEmail(Properties properties) throws Except if ("SSL".equalsIgnoreCase(encryption)) { email.setSSLOnConnect(true); email.setSslSmtpPort(portString); + email.setSSLCheckServerIdentity(true); } else if ("TLS".equalsIgnoreCase(encryption)) { email.setStartTLSEnabled(true); + email.setSSLCheckServerIdentity(true); } if (authentication) { diff --git a/server/src/main/java/com/mirth/connect/server/util/ServerSMTPConnection.java b/server/src/main/java/com/mirth/connect/server/util/ServerSMTPConnection.java index 47a1360500..c52c78f974 100644 --- a/server/src/main/java/com/mirth/connect/server/util/ServerSMTPConnection.java +++ b/server/src/main/java/com/mirth/connect/server/util/ServerSMTPConnection.java @@ -125,9 +125,11 @@ public void send(String toList, String ccList, String from, String subject, Stri if (StringUtils.equalsIgnoreCase(secure, "TLS")) { email.setStartTLSEnabled(true); + email.setSSLCheckServerIdentity(true); } else if (StringUtils.equalsIgnoreCase(secure, "SSL")) { email.setSSLOnConnect(true); email.setSslSmtpPort(port); + email.setSSLCheckServerIdentity(true); } // These have to be set after the authenticator, so that a new mail session isn't created