Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I having issues with postfix to send mail through SSL from an external webmail. I have several domain setup on my server configured in postfix with mysql. When I send mail with my main domain everything works fine but if send mail from I get this into my log:

Note that if I disable SSL on the webmail it works.

connect from unknown[78.209.78.XXX]
timeout after UNKNOWN from unknown[78.209.78.XXX]
disconnect from unknown[78.209.78.XXX]

Here is my

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
disable_vrfy_command = yes
smtpd_helo_required = yes
append_dot_mydomain = no

myhostname =
myorigin = $mydomain
mydestination =,, localhost
mynetworks = [::ffff:]/104 [::1]/128

alias_maps = hash:/etc/aliases
queue_directory = /var/spool/postfix
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

virtual_mailbox_domains = mysql:/etc/postfix/mysql/
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = mysql:/etc/postfix/mysql/
virtual_alias_maps = mysql:/etc/postfix/mysql/
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

smtpd_use_tls = yes
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
tls_random_source = dev:/dev/urandom

mail local si actif
smtpd_recipient_restrictions = permit_sasl_authenticated,
 check_policy_service unix:private/policy, # SPF

smtpd_sasl_auth_enable  = yes
smtpd_sasl_type         = dovecot
smtpd_sasl_path         = private/authnoactive, mutual_auth
broken_sasl_auth_clients = yes

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:
non_smtpd_milters = inet:

Note that on the webmail, I've set the smtp server to since I've read that I have to use the domain defined as Common Name in the tls certificate .

What I want is to make it work with SSL. Any idea about why it's not working ?


Here is new informations:

It seem that the problem is not related to domain1 or domain2 but occur only with new configurations. I had a domain that was setup since more than a year and everything was working fine. I removed it from my webmail and reconfigured it and now, I can't send mail.

While I was configuring it, I saw that it was asking me to use my https certificat and not the postfix one. So maybe the problem come from there but I don't know how to solve it.

Here is my apache conf:

<VirtualHost _default_:80>
  include /etc/apache2/domain.conf


<VirtualHost _default_:443>
  include /etc/apache2/domain.conf

  SSLEngine on
  SSLCertificateFile /etc/apache2/ssl/
  SSLCertificateKeyFile /etc/apache2/ssl/
  SSLCACertificateFile /etc/apache2/ssl/GandiStandardSSLCA.pem
  SSLVerifyClient None

Also if I do openssl s_client -connect localhost:465 I get that:

11508:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:607:

I don't know if it's normal for a self signed certificat.

share|improve this question
Can you post the error log from the webmail client? It would be nice to see what the client doesn't like.. – NickW Mar 13 '13 at 13:15
The webmail client tell me that the smtp server don't answer (I've just edit the log message in my post because it looks like I paste the wrong part). If I connect from roundcube on the server it works. POP and IMAP also works. – Nicolas BADIA Mar 13 '13 at 14:43
When you say send with, do you mean send as works, but sending as does not? – NickW Mar 13 '13 at 14:57
Yes, sending as doesn't work (except if I disable SSL on the webmail client) and sending as always works. – Nicolas BADIA Mar 14 '13 at 13:56
Hmm, what program are you using, roundcube? Do the server where the webmail client is installed have logs that might give more clues? /var/log/httpd/error.log, /var/log/messages/ etc? – NickW Mar 14 '13 at 14:02
up vote 1 down vote accepted

Postfix is not listening in smtpd_tls_wrappermode on port 465, but rather as a standard smtp server.

Your should contain a (multipart) line simliar to

smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject

However, it likely only has

smtps inet n - n - - smtpd

share|improve this answer
Oh men, thank you so much !!! You save my day ! – Nicolas BADIA Apr 18 '13 at 7:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.