Memory suggests I am not the only one here still using Turnpike. Anyone connecting via Zen?
Zen have updated their security requirements recently, and now require Encryption Type STARTTLS (if available) or TLS/SSL, which Turnpike does not provide.
Tried using Stunnel, to no avail.
It is only mail sending that fails. Incoming mail is fine, as are news (Usenet) sending and receiving.
Anyone else?
Didn't find your answer? Ask the community — no account required.
"2026.04.11 11:50:18 LOG5[176]: s_connect: connected 172.64.149.23:80
2026.04.11 11:50:18 LOG3[176]: OCSP: OCSP_basic_verify: 27069065: error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error
2026.04.11 11:50:18 LOG4[176]: Rejected by OCSP at depth=0: CN=*.zen.co.uk
2026.04.11 11:50:18 LOG3[176]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
2026.04.11 11:50:18 LOG5[176]: Connection reset: 0 byte(s) sent to TLS,
0 byte(s) sent to socket
Unfortunately, that is all way over my head.
T
Theo
Try adding:
OCSPaia=no OCSPrequire=no
as OCSP is gradually falling out of favour. It seems like your servers are not returning useful OCSP responses, so the above disables it. Background, in case you wanted to know:
formatting link
Theo
A
Andy Burns
wildcards normally only work one level deep, that seems to be expecting it to work two levels deep?
probably not the ultimate answer, but does adding "verify = 0" help?
G
Graeme
Tried, but Stunnel failed :
2026.04.11 12:42:48 LOG5[main]: Reading configuration from file stunnel.conf
2026.04.11 12:42:48 LOG5[main]: UTF-8 byte order mark detected
2026.04.11 12:42:48 LOG5[main]: FIPS mode disabled
2026.04.11 12:42:48 LOG3[main]: stunnel.conf:8: "OCSPrequire=no": Specified option name is not valid here
2026.04.11 12:42:48 LOG3[main]: Failed to reload the configuration file
Tried again, with OCSPrequire=no removed (using ;) and Stunnel worked, but mail still not sending.
Added the line Verify=0
but mail still not sending.
Error message from Turnpike :
Your message could not be delivered to the following recipients (address removed) Talking to [127.0.0.1] on Sat, 11 Apr 2026 12:47:19 +0100 >>> AUTH PLAIN Z3JhZW1lQGJpbm5zcm9hZC5teXplbi5jby51awBncmFlbWVAYmlubnNyb2FkLm15emVuLmNvL nVr ADE2TW9sZXdvb2Q= <<< 535 Incorrect authentication data
B
Bob Eager
I stopped using stunnel a while ago. Possibly the TLS version.
I use hitch now.
G
Graeme
Thank you. A quick look suggests hitch is for Linux, whereas I use windows (10, 32 bit).
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required
Report Content
You are reporting this content to the moderators. They will look at it
ASAP.