Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been running through a tutorial at: and everything works through the entire tutorial right up to checking the authentication.

While inside the instance, I can run:

[ec2-user@domU-... ~]$ openssl s_client -starttls smtp -connect localhost:25
didn't found starttls in server response, try anyway...
140326462789448:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:699:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 238 bytes and written 148 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
[ec2-user@domU-12-31-39-05-61-27 ~]$ 

But from my own laptop:

Drew-Sonnes-MacBook-Pro:~ drew$ openssl s_client -starttls smtp -connect
connect: Connection refused

I have port 25 open in my security group (and have for a few weeks). For the purpose of debugging my problem, I have iptables turned off:

[ec2-user@domU-... ~]$ sudo service iptables status
iptables: Firewall is not running.

I have requested my reverse DNS and port 25 open from Amazon, and they put that through a couple of days ago. I've made sure my DNS is resolving correctly. I've run through the tutorial, fixed typos, double & triple checked my settings, and can't find anything I've done wrong. Does anyone else know of anything else which would be stopping this?

share|improve this question
up vote 2 down vote accepted

This is with SASL. Key is the key, pem is the CA file, and crt and issued cert.


readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
virtual_alias_maps = hash:/etc/postfix/virtual
sender_bcc_maps = hash:/etc/postfix/bcc
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
mailbox_size_limit = 0
allow_percent_hack = no
## Specify the keys/certificates
smtpd_tls_key_file = /etc/pki/tls/private/localhost.key
smtpd_tls_CAfile = /etc/pki/tls/cert.pem
smtpd_tls_cert_file = /etc/ssl/certs/localhost.crt
smtpd_tls_security_level = may


# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet    n       -       n       -       -      smtpd    -o smtpd_sasl_auth_enable=yes
smtps     inet    n       -       n       -       -      smtpd    -o smtpd_sasl_auth_enable=yes
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.