Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to reject all connections that don't present a valid SSL/TLS certificate. First of all is the access db file the correct one to be changing?

I have already tried using the basic rule given in the documentation

CertIssuer:/C=US/ST=California/ Darth+20Mail+20+28Cert+29/ RELAY

This will obviously need a rule afterward to filter and reject all that don't present the cert? Does anyone have any pointers as to what syntax I should use? wildcards?


share|improve this question

Think I figured it out.. good old O'Reilly..

I just need to use:

TLS_Clt:                           VERIFY
TLS_Srv:                           VERIFY

Hopefully that will exclude all non valid certificates and all non secure connection attempts.

share|improve this answer

Note that it is unwise to force all SMTP clients to use TLS, as it is not yet widespread. The RFC document notes that publicly referenced SMTP servers, such as the MX servers for a domain, must not refuse non-TLS connections. However, restricted access SMTP servers, such as those for a corporate intranet, can use TLS as an access control mechanism.

If you remove PLAIN from, that should do it:


then rebuild with m4.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.