Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I have a lot of servers that I need to enable this on, I will be using a wildcard SSL certificate. I suppose if I simply go with Verisign that I probably will not have a problem with sending servers recognizing our certificate. However, I'm tempted to try a cheaper option such as RapidSSL or even cacert.org (which I understand provides free certificates). Does anyone have experience with using one of these cheaper options? Are their certs recognized by most mail servers?

When I try to find answers on this subject, it seems everyone is only worried about email client recognition... however, that is totally irrelevant to me as our servers are for inbound email only... no email clients ever connect to them.

share|improve this question
1  
I'm going to have to shoot this question as it's technically a shopping question, but if you want a trusted certificate on the cheap startssl.com offers them for free, and they're accepted by most major browsers (and pretty much everything that verifies trust chains uses the same CA lists as the browsers do). They don't do wildcard SSL for free (as far as I know), but you can sign up for one for each of your domains :) – voretaq7♦ Nov 11 '12 at 1:48

closed as not constructive by MDMarra, voretaq7♦ Nov 11 '12 at 1:48

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

1 Answer

up vote 8 down vote accepted

In my experience most mail servers don't verify the certificate. I've used self signed certificates on my mail servers for TLS for years and haven't seen any problems with delivery. So I'd give that a try first and see if the systems you are having trouble communicating with still don't work.

Postfix has a guide about different security levels for TLS here: http://www.postfix.org/postconf.5.html#smtp_tls_security_level

The relevant security levels they might be using are "encrypt", "verify", and "secure". All of them say "This security level is not an appropriate default for systems delivering mail to the Internet." Basically, the sending servers are doing it wrong. TLS should not be requires for internet email systems. But I'll assume you have no control over that.

If they are using the encrypt level, a self signed certificate will work just fine.

share|improve this answer
I agree, this is a proper solution. – pkhamre Aug 16 '12 at 13:45
1  
+1 A lot of packages in popular distros will generate a self signed certificate and enable as part of the install process automatically. – James Yale Aug 16 '12 at 14:01
Wow, I love serverfault. I couldn't find anyone discussing this issue anywhere... which should have made it obvious that a commercial cert just isn't required. Thanks, guys! – Curtis Aug 17 '12 at 18:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.