Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm configuring an internal mail network that is supposed to do all the transmission using ssl and I want to have all the encryption done by stunnel. So far I have pop3s, imaps and sendmail in server mode all using ssl encryption provided by stunnel. Is it possible to use stunnel to wrap outgoing connections with ssl ecnryption?

I so - how do I do this, I'm having difficulties finding a decent tutorial...

As I said in another question here - I'm a developer of an embedded platform - I don't usually configure anything as weird as sendmail...

share|improve this question
You say "internal mail network". Does that mean that it's really internal, and that noone external to your user base will ever send mail to, or receive it from, this server? Or are you hoping to exchange mail, either in- or out-bound, with other mail servers? – MadHatter Nov 3 '10 at 14:12
It's REALLY internal - as in not-connected-to-the-internet – user58292 Nov 3 '10 at 14:15
Then that begs the question, what outgoing connections do you think you'll need to encrypt? What is this server going to connect out to? – MadHatter Nov 3 '10 at 14:41
Oh I know what you mean - It's a number of smtp servers connected within an isolated network, but with no connection to the internet. By outgoing connections I meant sendmail connecting to another smtp server in client mode. Hope that's specific enough. Sorry if sometimes I can't express myself clearly - english is not my native language. – user58292 Nov 3 '10 at 14:52

1 Answer 1

up vote 0 down vote accepted

Your explanation is excellent and clear. If sendmail is configured to offer TLS, it is TLS-capable itself, and when connecting to another MTA offering TLS, will automatically negotiate a secure connection. There's a good article on this at .

My own m4 file says:

dnl TLS support
define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
define(`confSERVER_CERT', `/etc/pki/tls/certs/sendmail.pem')dnl
define(`confSERVER_KEY', `/etc/pki/tls/certs/sendmail.pem')dnl

And that, plus a self-signed certificate, was all I needed to make my server TLS-capable. You can test the capability by talking to the MTA and doing an EHLO:

[madhatta@risby tmp]$ telnet 25
Connected to
Escape character is '^]'.
220 : ESMTP banner removed
EHLO me Hello (source address deleted), pleased to meet you
250-SIZE 14000000
250 HELP

Note the 250-STARTTLS. Once all your sendmail boxes offer that capability, they should all automatically encrypt all inter-server SMTP connections. If you want to go the extra mile, minting your own CA root and installing it on all the servers, and using it to sign each server's certificate, will enable to servers to validate each other's identities when negotiating TLS, which will add to the internal security. Minting and using your own CA is outwith the scope of this answer!

share|improve this answer
Thanks, that got me a few steps further, but still there are some issues. I can't seem to find the ca-bundle.crt file on my system or any .crt file actually. And if I skip this one line I don't see the STARTTLS instruction in ehlo answer. Sendmail seems to have some TLS support though because when I run strings on the binary it has lots of TLS messages it didn't have before. If I add this line to the configuration: "DAEMON_OPTIONS(`Port=ssmtp, Name=TLSMTA, M=s')dnl" (found it somewhere on a mailing list) and try to telnet the 465 port it says: "454 4.3.3 TLS not available: error generating SSL – user58292 Nov 5 '10 at 11:40
handle". Any help? – user58292 Nov 5 '10 at 11:42
For me, it comes as part of the openssl package (openssl-0.9.8e-12.el5_4.6(; you have that installed, yes? Even if not, you're running all-internal so you won't be using publicly-verifiable certificates anyway and can probably safely omit the CA-related config. The TLS not available error is more problematic; can you confirm that you have the openssl package installed? – MadHatter Nov 5 '10 at 12:11
Yes the openssl libraries are compiled and installed and running sendmail -d0 indicates that it compiled properly with STARTTLS support. Issuing ehlo however does not show the STARTTLS command as available... This is the message it adds to /var/log/mail when I do type STARTTLS anyway: localhost [] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA – user58292 Nov 5 '10 at 12:40
Well I found the cause - the .key file I have to use is encrypted with a password, but sendmail did not prompt for it - I have to write my own callback it seems. Thanks for help! – user58292 Nov 8 '10 at 9:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.