SMTP port 465 (Implicit TLS) drops connection with "Socket closed unexpectedly" after successful TLS handshake — port 587 works fine

[julianwitzel]

Setup:

• Plunk version: 0.9.0 (image label shows "next", git revision e450ae6)
• Deployed via Docker Compose on Ubuntu 24.04
• Cert files: Let's Encrypt for smtp.mydomain.com
  • mounted to /certs/fullchain.pem and /certs/privkey.pem
• SMTP_DOMAIN=smtp.mydomain.com
• PORT_SECURE=465, PORT_SUBMISSION=587

Symptoms:

• Plunk startup logs show:
  ✔ Loaded certificates from PEM files
  ✔ SMTP server listening on port 465 (secure=true)
  ✔ SMTP server listening on port 587 (secure=false)
• TCP connect to port 465: succeeds (verified with nc -zv and openssl s_client)
• TLS handshake on 465: succeeds (verified with openssl s_client — cert chain validated, AEAD-AES256-GCM-SHA384)
• Immediately after handshake, Plunk logs:
  ✖ error SMTP server error on port 465: Socket closed unexpectedly
• Real SMTP clients (Python smtplib, Django EmailBackend) hit timeout
• Port 587 (STARTTLS) works perfectly with same cert files and same clients

What I've verified:

• Cert files md5sums match the Let's Encrypt originals (no corruption)
• Cert is read successfully by openssl s_client (Verify return code: 0)
• SMTP_DOMAIN env var is set correctly
• Both ports listening (docker exec plunk netstat -tln shows 465 + 587)

Diagnostic ask:

• Is there additional logging I can enable to see why the socket closes?
• Is SMTP_DOMAIN required to match a Traefik acme.json entry, or is /certs/*.pem mount a fully supported path?
• Any known issues with Implicit TLS on Node 20.20.2 + Plunk 0.9.0?