stream_socket_enable_crypto(): Peer certificate CN=`*.bluehost.com' did not match exp

After updating Zen Cart v154 to 155a, emails no longer works using smtpauth E-Mail Transport Method and produce error message like this in admin . . .

ERROR: Failed sending email to: "xxx" with subject: "xxx" SMTP connect() failed.

NB: smtpauth E-Mail Transport Method works with v154 and php E-Mail Transport Method works with v155a

Below is a Zen Cart generated debug log myDEBUG-adm-xxxx-yyyy.log

[29-Jun-2016 23:48:32] Request URI: /shop/myadmin/orders.php?selected_box=customers&status=2&page=1&oID=10786&action=update_order, IP address: https://mydomain.com
#1  stream_socket_enable_crypto() called at [/xxx/yyy/public_html/shop/includes/classes/vendors/PHPMailer/class.smtp.php:344]
#2  SMTP->startTLS() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1595]
#3  PHPMailer->smtpConnect() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1463]
#4  PHPMailer->smtpSend() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1300]
#5  PHPMailer->postSend() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1180]
#6  PHPMailer->send() called at [/xxx/yyy/public_html/mycatalog/includes/functions/functions_email.php:347]
#7  zen_mail() called at [/xxx/yyy/public_html/mycatalog/myadmin/orders.php:157]

[29-Jun-2016 23:48:32] PHP Warning:  stream_socket_enable_crypto(): Peer certificate CN=`*.bluehost.com' did not match expected CN=`mail.mydomain.com' in /xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.smtp.php on line 344
[29-Jun-2016 23:48:32] Request URI: /mycatalog/myadmin/orders.php?selected_box=customers&status=2&page=1&oID=10786&action=update_order, IP address: xx.xx.xx.xx
#1  trigger_error() called at [/xxx/yyy/public_html/mycatalog/includes/functions/functions_email.php:375]
#2  zen_mail() called at [/xxx/yyy/public_html/mycatalog/myadmin/orders.php:157]

[29-Jun-2016 23:48:32] PHP Notice:  Email Error: SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting<br /> in /xxx/yyy/public_html/mycatalog/includes/functions/functions_email.php on line 375
[29-Jun-2016 23:48:34] Request URI: /mycatalog/myadmin/orders.php?selected_box=customers&status=2&page=1&oID=10786&action=update_order, IP address: https://mydomain.com
#1  stream_socket_enable_crypto() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.smtp.php:344]
#2  SMTP->startTLS() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1595]
#3  PHPMailer->smtpConnect() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1463]
#4  PHPMailer->smtpSend() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1300]
#5  PHPMailer->postSend() called at [/xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.phpmailer.php:1180]
#6  PHPMailer->send() called at [/xxx/yyy/public_html/mycatalog/includes/functions/functions_email.php:347]
#7  zen_mail() called at [/xxx/yyy/public_html/mycatalog/myadmin/orders.php:171]

[29-Jun-2016 23:48:34] PHP Warning:  stream_socket_enable_crypto(): Peer certificate CN=`*.bluehost.com' did not match expected CN=`mail.mydomain.com' in /xxx/yyy/public_html/mycatalog/includes/classes/vendors/PHPMailer/class.smtp.php on line 344
[29-Jun-2016 23:48:34] Request URI: /mycatalog/myadmin/orders.php?selected_box=customers&status=2&page=1&oID=10786&action=update_order, IP address: xx.xx.xx.xx
#1  trigger_error() called at [/xxx/yyy/public_html/mycatalog/includes/functions/functions_email.php:375]
#2  zen_mail() called at [/xxx/yyy/public_html/mycatalog/myadmin/orders.php:171]

[29-Jun-2016 23:48:34] PHP Notice:  Email Error: SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting<br /> in /xxx/yyy/public_html/mycatalog/includes/functions/functions_email.php on line 375

Vitals:
Update done following official upgrade procedure uploading via FTP and running zc_install.
Linux Server
PHP Version: 5.6.17
Hosting: Bluehost shared server

Have you double-checked your Configuration->E-Mail Options settings?

FWIW, Bluehost has been having email "issues" over the past couple of weeks.

The more pertinent error message is shown in your logs:

stream_socket_enable_crypto(): Peer certificate CN=`*.bluehost.com' did not match expected CN=`mail.mydomain.com'

Evidently it's having trouble sending email securely due to SSL certificate mismatches.

DrByte:

The more pertinent error message is shown in your logs:

stream_socket_enable_crypto(): Peer certificate CN=*.bluehost.com' did not match expected CN=mail.mydomain.com'

> 
> Evidently it's having trouble sending email securely due to SSL certificate mismatches.

Thank you so much. I have no idea why using v155a produces the failure but v154 works just fine. All of the admin>E-Mail Option settings are identical.  As far as I can tell (which is admittedly not very far) the only difference between smtpauth working and not working is it works when I run Zen Cart v154 but does not work when I run Zen Cart v155a. So it seems that there is some key difference in how v155a does the task. I don't know what to do about it.

Well, v155 uses a significantly newer version of PHPMailer than what v154 did ... to handle all email activity, which probably enforces secure connections more efficiently, with more compliance than prior versions ... to keep up with modern security expectations.

Zean:

......... IP address: https://mydomain.com

Need to ask.... the error log is littered with references to "mydomain.com" .... is this because you (or some software) has obfuscated the stores real domain name?

Or,,,, is this telling us that something hasn't been configured yet?

Or perhaps this isn't technically a mail issue - but something really screwy going on with the DNS?

Or perhaps, just a really messed up SSL certificate?

I'm going for the SSL being mussed up. (DrBytes diagnosis too), which comes back to my question... Where is "mydomain.com" coming from? (that is what seems to be causing the mismatch!?)

Cheers
RodG

DrByte:

Well, v155 uses a significantly newer version of PHPMailer than what v154 did ... to handle all email activity, which probably enforces secure connections more efficiently, with more compliance than prior versions ... to keep up with modern security expectations.

Additional info . . . I installed v155a on a completely separate server from an unrelated Bluehost shared hosting account and unrelated domain and obtained the same error using smtpauth. So there may be something systematic going on with how Bluehost configures their servers. I'm not sure how to state what it is I want them to fix.
Can you help me with the words?

Also, yes RodG, for confidentiality, I edited the log filed by replacing all personally identifying info with generic strings like xxx, yyy, mycatalog, mydomain.

Note to self:
ZC155a is using PHPMailer 5.2.14
Is there a simple mod I could do to fix or workaround?

You could try:

• SMTP instead of SMTPAUTH -- this assumes that the PHP config on the server is properly configured by the hosting company to allow sending of emails amongst its servers without requiring auth to be passed. There are cons with this particularly if the resultant outgoing emails get flagged as not being authenticated.

• PHP instead of SMTP or SMTPAUTH -- again, relies on the PHP config between the host's servers to be set up to allow implicit authentication. Similar caveats.

• I haven't used it in years but in functions_email I'd built an ability to supply an explicit TLS certificate instead of trusting the server's configuration to be accurate. You've gotta find the expected defined constant and put a define for it into your extra_configures folder. Like I said, it was built a long time ago, before TLS support was baked into phpmailer and I know I've not bothered to do any regression testing with it. But if your host can't fix their TLS issues, you may have to go that route. You'll need to have your own publicly validated and trusted SSL certificate to use that.

• You might be able to get away with telling phpMailer that your server's hostname is not your_domain.com but rather something.bluehost.com and thus maybe it will trust the bluehost wildcard certificate. It's a wild shot but possible. Most people go the other direction: setting their actual domain name instead of it defaulting to the host's generic domain name. In essence, you could either comment out this entire section, or explicitly define EMAIL_HOSTNAME to something like *.bluehost.com or foobar.bluehost.com :

      // set Hostname, since it can aid in delivery of emails.
      $defaultHostname = preg_replace('~(^https?://|\/.*$)~', '', defined('HTTP_CATALOG_SERVER') ? HTTP_CATALOG_SERVER : HTTP_SERVER);
      // If emails are being rejected, comment out the following line and try again:
      $mail->Hostname = defined('EMAIL_HOSTNAME') ? EMAIL_HOSTNAME : $defaultHostname;

In hindsight, maybe try the last one first.

Thanks DrByte!:smile:
Problem is resolved. Here's the fix . . .

ZC155a Configuration > E-Mail Options settings > SMTP Email Mail Host

Instead of setting the SMTP Email Mail Host to mail.mydomain.com where "mydomain" is the domain containing the Zen Cart store,
I set SMTP Email Mail Host to mailserver.bluehost.com where "mailserver" is a specific mail server name provided by Bluehost.

DrByte, please let me know when you get a BitCoin account so I can send some love.

Zean:

E-Mail Options settings > SMTP Email Mail Host

Instead of setting the SMTP Email Mail Host to mail.mydomain.com where "mydomain" is the domain containing the Zen Cart store,
I set SMTP Email Mail Host to mailserver.bluehost.com where "mailserver" is a specific mail server name provided by Bluehost.Good call. Sometimes it's hard to recognize the uniqueness of which mailserver hostname is necessary, particularly when the hosting company does unconventional things.

Zean:

DrByte, please let me know when you get a BitCoin account so I can send some love.
Will do. Presently the donate links below don't support BitCoin yet, but will accept other methods ;)