Standard SMTP Email Plugin Notifications Fail with TlsNoCloseNotifyException After Upgrading to VCF Operations 9.1.x

Products

• VCF Operations

Issue/Introduction

• After upgrading from VMware Aria Operations 8.18.x to VCF Operations 9.1.x, outbound email notifications using the standard SMTP email plugin fail to trigger.
• The VCF Operations UI displays the warning symptom:

  Failed to send an outbound alert notification

• Testing the email plugin configuration results in the error: 

  Email test failed: [Exception reading response]

• The analytics log (/storage/log/vcops/log/analytics-<node_UUID>.log) files indicate a TLS handshake failure with the following error:

  org.bouncycastle.tls.TlsNoCloseNotifyException: No close_notify alert received before connection closed

Environment

• VCF Operations 9.1.x

Cause

• The issue is a functional breakage resulting from strict security hardening and platform-wide dependency changes introduced in VCF Operations 9.1.
• The email library was migrated to Eclipse Angus Mail (Jakarta Mail), and the default JSSE provider was changed from SunJSSE to BouncyCastleJsseProvider.
• The new BouncyCastle TLS implementation strictly enforces official IETF TLS specifications (RFC 5246 for TLS 1.2 and RFC 8446 for TLS 1.3).
• The strict enforcement requires the receipt of a close_notify shutdown alert before treating a TLS session as cleanly terminated.
• The SMTP relay server drops the TCP connection immediately after processing the MAIL FROM command without sending the required close_notify alert.
• While the older SunJSSE provider silently tolerated this abrupt server closure, version 9.1 treats the undocumented socket drop as a fatal protocol violation.

Resolution

To resolve this issue, perform the following validation steps:

1. Verify that the SMTP Server field in the Outbound Notification settings is configured using the fully qualified domain name (FQDN) rather than an IP address to ensure valid certificate SAN/CN matching.
2. Ensure that the "STARTTLS Encryption" protocol is correctly enabled if the SMTP server requires it.
3. If the environment is behind a load balancer or utilizes multiple mail nodes, confirm that all nodes are configured to accept authentication from the VCF Operations cluster IP addresses.
4. If authentication issues persist, consult your SMTP administrator to confirm if the mail server requires explicit authentication credentials (username/password) or if the relay policy has changed to disallow anonymous SMTP submissions from the new VCF Operations version.
5. The SMTP server must be reconfigured to send a close_notify alert during the TLS handshake to comply with the latest IETF security standards.
6. Applying this configuration on the SMTP server will ensure the TLS session is treated as cleanly terminated by the VCF Operations 9.1.x security libraries, allowing emails to route successfully.

Additional Information

• The close_notify alert acts as a mandatory cryptographic security boundary that guarantees the completeness of a data stream.
• Requiring a signed close_notify alert protects the application against several specific network attack vectors.
• This strict protocol protects against TLS Truncation Attacks (Stream Truncation), Session Hijacking via Early Closure, Command/Data Deletion Attacks (Context Stripping), and Denial of Service via Resource Exhaustion.