TLS Icon showing unencrypted connection

[chittaranjan870]

Return-Path: <connectixtest@gmail.com>
Received: from mail.tcubemail.com ([unix socket])
    by mail.tcubemail.com (Cyrus 3.0.13-Debian-3.0.13-5) with LMTPA;
    Sat, 16 Aug 2025 16:34:35 +0530
X-Cyrus-Session-Id: cyrus-1114755-1755342275-2-5632078351352928776
X-Sieve: CMU Sieve 3.0

Received: from localhost (localhost [127.0.0.1])
    by mail.tcubemail.com (Postfix) with ESMTP id 3DF1B1E7722
    for <admin@tcubemail.com>; Sat, 16 Aug 2025 16:34:35 +0530 (IST)
Authentication-Results: mail.tcubemail.com;
    dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=GlrCbQdx;
    dkim-atps=neutral
X-Virus-Scanned: Debian amavisd-new at tcubemail.com

Received: from mail.tcubemail.com ([127.0.0.1])
    by localhost (mail.tcubemail.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 8jR1M8qZmLkX for <admin@tcubemail.com>;
    Sat, 16 Aug 2025 16:34:30 +0530 (IST)
X-Comment: SPF skipped for whitelisted relay - client-ip=209.85.216.48; helo=mail-pj1-f48.google.com; envelope-from=connectixtest@gmail.com; receiver=<UNKNOWN>

**Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48])
    (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
    key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
    client-signature RSA-PSS (2048 bits) client-digest SHA256)
    (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
    by mail.tcubemail.com (Postfix) with ESMTPS id C592D1E75FB
    for <admin@tcubemail.com>; Sat, 16 Aug 2025 16:34:30 +0530 (IST)**

Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-323267bc0a8so3752148a91.1
    for <admin@tcubemail.com>; Sat, 16 Aug 2025 04:04:30 -0700 (PDT)

[GermanCoding]

You have lots of internal hops, which are all unencrypted. As per the README:

This also only validates the last hop of an email - some emails may run through multiple hops and we don't know anything about the security of these.

Please see issue #3 for discussion about this exact topic. There's a config option to ignore a certain number of internal hops:

Roundcube_TLS_Icon/config.inc.php.dist

Line 10 in 1b23b48

$config['tls_icon_ignore_hops'] = 0;

[chittaranjan870]

You have lots of internal hops, which are all unencrypted. As per the README:

This also only validates the last hop of an email - some emails may run through multiple hops and we don't know anything about the security of these.

Please see issue #3 for discussion about this exact topic. There's a config option to ignore a certain number of internal hops:

Roundcube_TLS_Icon/config.inc.php.dist

Line 10 in 1b23b48
$config['tls_icon_ignore_hops'] = 0;

Ok, but is there any solution ? I have ignore hops till 6 but not showing.

[GermanCoding]

If your number of internal hops is constant (it appears to be 3), set ignore hops to 3.

[GermanCoding]

You also need to rename the config file, the file in the repo is named ".dist" for distribution as it's just an example. You either need to set this config value in your main config, or rename the file to config.inc.php.

[chittaranjan870]

Yes I have renamed and set it to 3 but still same showing.

Return-Path: <connectixtest@gmail.com>
Received: from mail.tcubemail.com ([unix socket])
    by mail.tcubemail.com (Cyrus 3.0.13-Debian-3.0.13-5) with LMTPA;
    Sat, 16 Aug 2025 17:15:27 +0530
X-Cyrus-Session-Id: cyrus-1117391-1755344727-2-1387441878544102775
X-Sieve: CMU Sieve 3.0
Received: from localhost (localhost [127.0.0.1])
    by mail.tcubemail.com (Postfix) with ESMTP id 3970B1E888F
    for <admin@tcubemail.com>; Sat, 16 Aug 2025 17:15:27 +0530 (IST)
Authentication-Results: mail.tcubemail.com;
    dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=h5BRbBg6;
    dkim-atps=neutral
X-Virus-Scanned: Debian amavisd-new at tcubemail.com
X-Spam-Flag: NO
X-Spam-Score: 1.792
X-Spam-Level: *
X-Spam-Status: No, score=1.792 tagged_above=-9999 required=6.31
    tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
    DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001,
    PYZOR_CHECK=1.985, RCVD_IN_DNSWL_BLOCKED=0.001,
    RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001,
    RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001,
    RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001,
    SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from mail.tcubemail.com ([127.0.0.1])
    by localhost (mail.tcubemail.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 21APyK2ObaC8 for <admin@tcubemail.com>;
    Sat, 16 Aug 2025 17:15:22 +0530 (IST)
X-Comment: SPF skipped for whitelisted relay - client-ip=209.85.215.170; helo=mail-pg1-f170.google.com; envelope-from=connectixtest@gmail.com; receiver=<UNKNOWN>
Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170])
    (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
    key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
    client-signature RSA-PSS (2048 bits) client-digest SHA256)
    (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
    by mail.tcubemail.com (Postfix) with ESMTPS id 680221E8889
    for <admin@tcubemail.com>; Sat, 16 Aug 2025 17:15:22 +0530 (IST)
Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-b47173a7e50so2516766a12.1
    for <admin@tcubemail.com>; Sat, 16 Aug 2025 04:45:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=gmail.com; s=20230601; t=1755344719; x=1755949519; darn=tcubemail.com;
    h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
    :date:message-id:reply-to;
    bh=blvqYyScn0EhmrLG/Lp9kivvfZwWaGFvH9Sdec/T6XY=;
    b=h5BRbBg6hGyLCPBntxBduW5ZHxCO/TnQAgl9FU4dvaOKbYEpf2vdf6BIAjjpqO6g5Y
    UPw6GcaPEuQ9t6o9irMXPllxGPETAM383Wd/nVVhNZbXxBe8Ef9pembe1uJ8pqpPxt3L
    1Yurxd/+CaDg05Udd+XhzWuZ4pRRBJS6Kq+3ON3vttdET0BMK8X0/0D+t1FhrC7UqyUn
    tsoq48jjHb4Uayc7taYgIMaOXzqXMrzvBoXJepxndOf2XRI8MIwXSI/WJvnwLXQm5F8S
    fwkNNZ1XDIyVfmIQOQpSW9lxNGmn8o/ufXFYfvme0bG0XboFKIHZLBd81i33nmvkB5X+
    I1QQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=1e100.net; s=20230601; t=1755344719; x=1755949519;
    h=to:subject:message-id:date:from:mime-version:x-gm-message-state
    :from:to:cc:subject:date:message-id:reply-to;
    bh=blvqYyScn0EhmrLG/Lp9kivvfZwWaGFvH9Sdec/T6XY=;
    b=GtMRb6dC/ct0LRKzPJt4DAjVgy5RTldt4tuOsj4OycKcLCWDXRzDRPcIw67UWdEYd6
    jELa03BV0o0mG9E1aKoMCQq6naWbnJFhm5AHl3UV2Bt37h+0DpSyPG6oDqUUC5Qo3NCe
    jXs3Z1RjIeb19E1YW9xO1+lzcZdf6QFundlKR/qrOSo1HSBwkzHOfJp1cxEMJscKsn/n
    HeQis8N/TxrQK8heevXG0ai5FLlSuqvH5I2B2DDEl0vu9kM+pel7mJ/08A0zVc0qbCQF
    lVKQ9+mjYoD6zB3qmHIvg9KLNw1V/PSEOy+kpXUw1wTRorcuqdV/7P4tkQeTTRM4oEyq
    lzZA==
X-Gm-Message-State: AOJu0Yy3lWAKkfWGvrWCRfZ7UUvpIZsjIeImnwvgkIZ7MhmSekjt4dQU
    RR6UMXTuYEIH59aXkKMZ9MKWBIPf1MC20fwZYTMrKbfh3Qn7uuFIBBxjiDiRkE5lHUGpSb70kwo
    eYTCxc/cXhNbyi2sPqssbm2bgR8hIh9kdQQ==
X-Gm-Gg: ASbGncsnQxExVEQgg02/X31oBxCbLIoSGGchF/jmdKw3FHLF1DgF85Jcfq4+FtWxCg/
    GGvi3ue+tOeOfAd+s07sLj/rl+my5AJvX6s3fIvC+u36EJwCnfXi7GG6GBgbZyCioN5ZX0avhZn
    c/tmsfjLB9E4UsPA22ba3U/M6qpBY20XNgtAdqNjfWfrJKSzbVDvSkiq7bEf/8hEr0gozFA/cf+
    bhUBxM=
X-Google-Smtp-Source: AGHT+IFLjVL1Vm+8FTDdIZwHjM0LYX8shyRNmq5d4n8kDd/KqbVqJh54SDm2yXzdCFxSjCUsDVv5E2X64an2RpHGnQ0=
X-Received: by 2002:a17:903:1b2d:b0:240:8cec:4823 with SMTP id
    d9443c01a7336-2446d8e4cd1mr81896095ad.41.1755344719394; Sat, 16 Aug 2025
    04:45:19 -0700 (PDT)
MIME-Version: 1.0
From: connectix test <connectixtest@gmail.com>
Date: Sat, 16 Aug 2025 17:15:08 +0530
X-Gm-Features: Ac12FXweH4K2or7inz2XAGsj2sGHe04y3qP92gSUarmvuDFSgqCDgIyB43ktSws
Message-ID: <CANsOJTBkVd=DC8BvR02chT-m8QBdYTxBqkcZHeF8hb-KWkpiQw@mail.gmail.com>
Subject: test10
To: admin@tcubemail.com
Content-Type: multipart/alternative; boundary="000000000000753b38063c7a0a0f"

cat config.inc.php

$config['tls_icon_ignore_hops'] = 3;

[chittaranjan870]

I have skip last 3 hops process and set $config['tls_icon_ignore_hops'] = 1;
but status same

Return-Path: <connectixtest@gmail.com>

Received: from mail.tcubemail.com ([unix socket])
    by mail.tcubemail.com (Cyrus 3.0.13-Debian-3.0.13-5) with LMTPA;
    Tue, 19 Aug 2025 17:09:04 +0530
X-Cyrus-Session-Id: cyrus-1333035-1755603544-1-1679961472873880100
X-Sieve: CMU Sieve 3.0
X-Comment: SPF skipped for whitelisted relay - client-ip=209.85.210.169; helo=mail-pf1-f169.google.com; envelope-from=connectixtest@gmail.com; receiver=<UNKNOWN>
Authentication-Results: mail.tcubemail.com; dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-Results: mail.tcubemail.com; spf=pass smtp.mailfrom=connectixtest@gmail.com
Authentication-Results: mail.tcubemail.com;
    dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=dza0Aaql;
    dkim-atps=neutral

Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169])
    (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
    key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
    client-signature RSA-PSS (2048 bits) client-digest SHA256)
    (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
    by mail.tcubemail.com (Postfix) with ESMTPS id 746951E199C
    for <admin@tcubemail.com>; Tue, 19 Aug 2025 17:09:04 +0530 (IST)

Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-76e2eb09041so4321030b3a.3
    for <admin@tcubemail.com>; Tue, 19 Aug 2025 04:39:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=gmail.com; s=20230601; t=1755603542; x=1756208342; darn=tcubemail.com;
    h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
    :date:message-id:reply-to;
    bh=03BytqDT5HqOwLniXrBoL6pt4U0tBVt1BYi80X3+Tjw=;
    b=dza0AaqlA+zNGPnPhDd9eykyC79ZJc5dwAs9wUbE4+RT6qpNEzzz/H8RlwFJY/rhIf
    qXMFNJEfQCAAz2f9uJO6x4CWdvEITFg/aNbCBWkIkWc7ALh5J1AXg8qZTyBjju2aZg7O
    rpYW2kSMmOF280ASfmYvhA0dfFlLhQks3rS/DU0yW6Wht853U81hI2Xs4L8LXhqzEKRm
    +cCrrJMaKOISvO9DP11D8DmHp7la9xvjaDuQ6HB50DkfLc0K0Yn/MWt4biU1XwKSuCmJ
    O9KyQkAmvyy8NJGWEU5gmi8SQfkw9EzMXAiFoNmmVv0WMMi8YOp1JVkp9Gg39CUgMxNd
    so3w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=1e100.net; s=20230601; t=1755603542; x=1756208342;
    h=to:subject:message-id:date:from:mime-version:x-gm-message-state
    :from:to:cc:subject:date:message-id:reply-to;
    bh=03BytqDT5HqOwLniXrBoL6pt4U0tBVt1BYi80X3+Tjw=;
    b=PHVr6KACwVXkBzbWCh4filzOEM+6xt9EC4JDYlWL6nViiXV6QRyI2U4pc0c8TD6Yeh
    /SMJJA4O13zQy/szIDckvvqczq+tUJ8CkHHz1f1KU3xfmWLUZqQcx/fHXdWhQxlmNUh2
    k1GW0VZ0iAyUefvjgE2bUqP/z0AeEWmMk+ZLBz4Qd2aGUs2hzY8Gfz5TJfNfEtP0yXet
    b9gjVE08ONS0cn+lhS6S+5+hH28ZR/4XHj0Bx/SnhN9v1PRMPgPEw/YozuXu/FwItsha
    n0tKQ6RHvP4gYfmpvp9hUJWUW5eJUV6mrgqk5HoVD2loPLB5E+opRVKw8QPfnCEWsyAx
    zukQ==
X-Gm-Message-State: AOJu0YwIvrV4i3t5zpGoNeMUYIzMya7zB3xRr1CXM8QedBsV6KHfMhQw
    MRIiJKsgAdr3row5MWoekaeojo/umKmGejjAmbAMpkdOLN6Fkh4hY7hScOfZDyP1R2w4os8Qrq8
    p1qp+l9dA7q8gdG7dt6P0DX73iHpPwIglDA==
X-Gm-Gg: ASbGncvLNWojaVZI4JPWUnAjdKQbKatAh81nS9qP3U7kl2XW+sVeF/6K8IDHKBcpXbC
    ksdY6MrOcrPZP03EuGtOMQYQsy5LCIvZN8sjQRB4byKj1VpLx50+8fClD8hiYQreVn55zsra53V
    U05Owmr3BYRx0fegcjuzDapj9QWUzibWjh5ACW2sObeKOyqCD2s91lazFmCPc8hI+6KbVr6NNly
    AoYACs=
X-Google-Smtp-Source: AGHT+IGepyvrMtJxZiYfuuDGzKqZIkotXKMer7lC02iVrIQsq8SGJJ4MxZuWEc/aMmyEmWYtwxO6il9M/FaFMx/W0PM=
X-Received: by 2002:a05:6a20:3c90:b0:240:1f14:f6b1 with SMTP id
    adf61e73a8af0-2430d382d2cmr3176740637.13.1755603541558; Tue, 19 Aug 2025
    04:39:01 -0700 (PDT)
MIME-Version: 1.0
From: connectix test <connectixtest@gmail.com>
Date: Tue, 19 Aug 2025 17:08:50 +0530
X-Gm-Features: Ac12FXw0cnGaSSG5SBTqJGmkhKPG3XWLqNqFZscSw5xCXnjSWLdITThtxyQiMi4
Message-ID: <CANsOJTAF9qX0R50FbuTug4-K5eq4SESG4b9Te_HNkCDY=VKqyw@mail.gmail.com>
Subject: test12345
To: admin@tcubemail.com
Content-Type: multipart/alternative; boundary="000000000000761544063cb64dcd" 

[christiaangoossens]

Likely fixed by #28