Play Framework

fix(security)!: verify SMTP server certificates on the ssl channel

BREAKING CHANGE: mail.smtp.channel=ssl now verifies the SMTP server's
certificate. Sending to a server with a self-signed or internal-CA certificate
will start failing at runtime; install the certificate in the JVM truststore,
or set mail.smtp.ssl.cavalidation=false to restore the old behaviour.

Selecting the ssl channel installed YesSSLSocketFactory unconditionally - a
TrustManager that accepts any certificate. Picking the *secure-looking* option
therefore silently disabled verification, so anyone on the path to the SMTP
server could read the message and the SMTP AUTH credentials, which are sent
after the handshake. The operator had no way to notice: nothing in the config
or the logs said verification was off.

Now validated by default, with an explicit opt-out that logs a WARN naming the
host whenever it is active, so the exposure is auditable instead of silent.
This mirrors ssl.cavalidation, which already guards the equivalent behaviour in
WSSSLContext and correctly defaults to true.

Also sets mail.smtp.ssl.checkserveridentity - jakarta.mail 2.0.x defaults it to
false, which would check the chain is trusted but not that the certificate
belongs to the host actually dialled, leaving the MITM open to anyone holding
any trusted certificate.

The starttls channel is unaffected: it never installed the permissive factory.
It does not set checkserveridentity either, which is a narrower gap worth a
separate look.

Tests: MailSslTest asserts the secure default (ssl.enable, checkserveridentity,
no socket factory) and that the opt-out still works. Verified by flipping the
default to false - 1 of 2 goes red. Documented in manual/configuration.textile
with an upgrade note. Full ant test passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>