I have 2 Linux CentOS 7 machines, a Samba server and a Postfix server. The Postfix server is configured to use SASL authentication and TLS encryption. On the Samba server, I can connect to the Postfix server using openssl. [root@samba1 ~]# openssl s_client -connect mail.example.com:587 -starttls smtp -CAfile /etc/pki/tls/mail.example.com.pemWhen I use mailx on the Samba server, I get message SSL/TLS handshake failed: Unknown error -5938. [root@samba1 ~]@ echo Hello World | mailx -v -s Test -A default first.last@hotmail.comResolving host mail.example.com . . . done.Connecting to 192.168.0.10:587 . . . connected.SSL/TLS handshake failed: Unknown error -5938.In /var/log/maillog on the Postfix server, I do see a few TLS events.Nov 25 19:23:05 mail postfix/smtpd[5659]: initializing the server-side TLS engineNov 25 19:23:05 mail postfix/smtpd[5659]: connect from samba1.example.com[192.168.0.12]Nov 25 19:28:05 mail postfix/smtpd[5659]: timeout after UNKNOWN from samba1.example.com[192.168.0.12]This is my /etc/mail.rc file on the Samba server.[root@samba1 ~]# cat /etc/mail.rcaccount default {set smtp=smtps://mail.example.com:587#Authenticationset smtp-auth=loginset smtp-auth-user=my.email@example.comset smtp-auth-password=my_password#Encryptionset smtp-use-starttlsset nss-config-dir=/etc/pki/nssdb}set holdset appendset askset crtset dotset keepset emptyboxset indentprefix=> set quoteset sendcharsets=iso-8859-1,utf-8set shownameset showtoset newmail=nopollset autocollapseset markansweredignore received in-reply-to message-id referencesignore mime-version content-transfer-encodingfwdretain subject date from toset bsdcompatThis article suggests to comment out smtp-use-starttls, which seems to not apply to my situation, since my Postfix server is configured to use TLS. If I comment out smtp-use-starttls, I stil get the 5938 message.This post suggests that you can ensure both servers are using the same version of TLS. I added ssl-method=tls1 to /etc/mail.rc on the Samba server, and I still get the 5938 message.Using certutil, I do see my certificate in /etc/pki/nssdb on the Samba server, and it is valid. [root@samba1 ~]# certutil -V -n mail.example.com.crt -d /etc/pki/nssdb -u Acertutil: certificate is validHere is the contents of nssdb-rw-r--r--. 1 root root 65536 Nov 25 17:56 cert8.db-rw-r--r--. 1 root root  9216 Jun 26 08:51 cert9.db-rw-r--r--. 1 root root 16384 Nov 25 17:56 key3.db-rw-r--r--. 1 root root 11264 Jun 26 08:51 key4.db-rw-r--r--. 1 root root   451 Apr 25  2016 pkcs11.txt-rw-r--r--. 1 root root 16384 Apr 25  2016 secmod.dbI am not certain what I should do next for this anomaly.
Mailx SSL/TLS handshake failed: Unknown error -5938
postfix;ssl;mailx
dave_thompson_085 answered in the comments:smtps: means to initially connect with SSL/TLS, which 587 does not support. You want to connect then start SSL/TLS, which is generically called starttls. Use:smtp=server:587and smtp-use-starttls