{"record":{"id":"73c3ec093ba4f9b6","repo":"ellite/Wallos","slug":"message-getsmtperrormessage-connect-host","errorCode":null,"errorMessage":"$message (getSmtpErrorMessage('connect_host'))","messagePattern":"\\$message \\(getSmtpErrorMessage\\('connect_host'\\)\\)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"libs/PHPMailer/PHPMailer.php","lineNumber":2210,"sourceCode":"                    //Automatically enable TLS encryption if:\n                    //* it's not disabled\n                    //* we are not connecting to localhost\n                    //* we have openssl extension\n                    //* we are not already using SSL\n                    //* the server offers STARTTLS\n                    if (\n                        $this->SMTPAutoTLS &&\n                        $this->Host !== 'localhost' &&\n                        $sslext &&\n                        $secure !== 'ssl' &&\n                        $this->smtp->getServerExt('STARTTLS')\n                    ) {\n                        $tls = true;\n                    }\n                    if ($tls) {\n                        if (!$this->smtp->startTLS()) {\n                            $message = $this->getSmtpErrorMessage('connect_host');\n                            throw new Exception($message);\n                        }\n                        //We must resend EHLO after TLS negotiation\n                        $this->smtp->hello($hello);\n                    }\n                    if (\n                        $this->SMTPAuth && !$this->smtp->authenticate(\n                            $this->Username,\n                            $this->Password,\n                            $this->AuthType,\n                            $this->oauth\n                        )\n                    ) {\n                        throw new Exception($this->lang('authenticate'));\n                    }\n\n                    return true;\n                } catch (Exception $exc) {\n                    $lastexception = $exc;","sourceCodeStart":2192,"sourceCodeEnd":2228,"githubUrl":"https://github.com/ellite/Wallos/blob/52820e87ca5a6e105fdbb7f1c0c681bc0cfee2fd/libs/PHPMailer/PHPMailer.php#L2192-L2228","documentation":"Thrown inside smtpConnect()'s host loop when STARTTLS negotiation fails: $this->smtp->startTLS() returns false after a plain connection with the server advertising STARTTLS. The message comes from getSmtpErrorMessage('connect_host') (typically 'SMTP connect() failed' plus debug info). Note the generic message can be misleading — the real cause is the TLS handshake, visible only with SMTPDebug.","triggerScenarios":"Calling send() with isSMTP() when the server advertises STARTTLS but startTLS() fails: bad/mismatched certificates, untrusted self-signed cert, missing CA bundle (cafile not set), cipher mismatch, or server advertises TLS but is misconfigured.","commonSituations":"Self-signed or expired certificates on internal SMTP relays, missing/update ca-certificates package, localhost/test SMTP servers (MailHog) without valid certs, SMTPOptions ssl verify_peer settings blocking the handshake.","solutions":["Enable SMTPDebug = DEBUG_SERVER to see the actual TLS handshake error behind the generic message.","Fix certificates: use a valid cert on the server or add its CA to the trust store / set $mailer->SMTPOptions['ssl']['cafile'].","For dev/test relays only, relax verification: SMTPOptions = ['ssl' => ['verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true]].","Update the system CA bundle (apt-get install ca-certificates / update-ca-certificates).","If TLS is optional, disable it (SMTPSecure = '') only when the server genuinely permits plain sessions."],"exampleFix":"// before (self-signed internal relay)\n$mailer->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS; // startTLS() fails\n// after\n$mailer->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;\n$mailer->SMTPOptions = [\n    'ssl' => [\n        'verify_peer' => true,\n        'cafile' => '/etc/ssl/certs/internal-ca.pem', // trust the relay's CA\n    ],\n];","handlingStrategy":"try-catch","validationCode":"$ctx = stream_context_create(['ssl' => ['capture_peer_cert' => true]]);\nif (@stream_socket_client(\"tcp://{$mailer->Host}:{$mailer->Port}\", $errno, $errstr, 5, STREAM_CLIENT_CONNECT, $ctx) === false) {\n    error_log(\"Pre-check: cannot reach {$mailer->Host}:{$mailer->Port}: $errstr\");\n}\n// also confirm CA trust: openssl s_client -starttls smtp -connect host:port -CApath /etc/ssl/certs","typeGuard":null,"tryCatchPattern":"try {\n    $mailer->send();\n} catch (PHPMailer\\PHPMailer\\Exception $e) {\n    if (str_contains($mailer->ErrorInfo, 'connect_host')) {\n        error_log('STARTTLS likely failed: rerun with SMTPDebug=DEBUG_SERVER for handshake detail');\n        // fix CA trust or relax SMTPOptions for trusted internal relays only\n    }\n}","preventionTips":["Keep system CA bundles updated (ca-certificates).","Use valid certificates on internal SMTP relays; add custom CAs via SMTPOptions['ssl']['cafile'].","Restrict verify_peer=false to dev/test environments only.","Enable SMTPDebug when a generic connect_host message hides a TLS failure."],"tags":["php","phpmailer","starttls","tls-handshake","smtp"],"backgroundTag":"invalid-config-value","analyzedSha":"52820e87ca5a6e105fdbb7f1c0c681bc0cfee2fd","analyzedAt":"2026-09-13T14:09:30.873Z","contentChangedAt":"2026-09-13T14:09:30.873Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}