Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im currently experiencing the following issue with postfix over ssl (smtps)

Apr  7 13:43:55 server88-208-248-147 postfix/smtpd[5777]: connect from xxxxxxxxxxxxxxx[]
Apr  7 13:45:09 server88-208-248-147 postfix/smtpd[5777]: lost connection after UNKNOWN from xxxxxxxxxxxxxxx[]
Apr  7 13:45:09 server88-208-248-147 postfix/smtpd[5777]: disconnect from xxxxxxxxxxxxxxx[]

my is as follows:

smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtp_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_CAfile = /etc/postfix/caroot.crt
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_loglevel = 1

when accessing smtp and running start tls i get the following:

# telnet xxxxxxxxxxxxxxx 25
Trying xxxxxxxxxxxxxxx...
Connected to xxxxxxxxxxxxxxx .
Escape character is '^]'.
220 xxxxxxxxxxxxxxx ESMTP Postfix
ehlo localhost
250-SIZE 10240000
250 DSN
220 2.0.0 Ready to start TLS

please help as i'm lost of places to look now.

os is Ubuntu 10.4 and the SSL is a wildcard SSL, imap/pop and apache work flawlessly with the same certificate.

share|improve this question
up vote 1 down vote accepted

Have you checked the file permissions for

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Are these files being created?

What happens if you temporarily disable those lines?

Also try increasing the log level to 3 or 4.

EDIT: These are additional lines I added to (postfix 2.5.1):

# TLS stuff
smtps     inet  n       -       y       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
submission inet n       -       y       -       -       smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
scache    unix  -       -       n       -       1       scache
discard   unix  -       -       n       -       -       discard
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
retry     unix  -       -       n       -       -       error
proxywrite unix -       -       n       -       1       proxymap
share|improve this answer
Hi thanks, When i uncomment this it still does the same, Checking the file permissions on /var/lib/postfix/smtp_scache.db i get the following: 16K -rw------- 1 postfix postfix 16K 2011-04-08 11:00 /var/lib/postfix/smtp_scache.db Any additonal pointers? – davidcollom Apr 8 '11 at 10:13
Have you increased the loglevel? Also, where are your certs from? – jamespo Apr 9 '11 at 9:06
I tried increasing the log level. And saw the certificate exchange. I couldn't see any obvious errors pop up. The certificate is a wildcard certain from rapidssl and apache/courier appear to use them fine. Also TLS over standard smtp is working perfectly fine using the same certificates – davidcollom Apr 10 '11 at 16:25

I seem to remember that /etc/postfix/ssl and its contents had to be chown root:0

I have it working and just have:

smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

250-SIZE 10240000
250 DSN

share|improve this answer
Hi. Not sure you gasped the issue TLS via standard smtp is fine! However smtp over ssl(smtps) is not working. Or just hanging when the initial connection is made. – davidcollom Apr 8 '11 at 19:52
Sorry, I didn't get that. Is there another setting required for SMTPS then ? One that's not present. – Jonathan Ross Apr 9 '11 at 6:22

This is the way to test STARTTLS with your smtp server:

openssl s_client -starttls smtp -connect
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.