Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I configurated postfix to force uses TLS. When an external client try to send an email using this server there is not any problems. But using webmail ( postfix wants TLS:

delivery temporarily suspended: TLS is required, but was not offered by host[])

Which changes I need to do to

smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/postfix/ssl/xxx.key
smtpd_tls_cert_file = /etc/postfix/ssl/xxx.crt
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
share|improve this question

You could:

  1. smtp_tls_security_level = may
    This will allow your server to deliver mail to hosts that don't offer TLS or hosts with bad certificates (as it would otherwise retry unencrypted).
  2. smtpd_tls_security_level = may This will cause your server to offer TLS encryption to clients on any listening port.
  3. smtpd_tls_security_level = encrypt This will cause your server to require TLS encryption from all client on any listening port.

For internet hosts it's common to do both 1 and 2, but you know your requirements better than I do.

share|improve this answer

I doubt you can do that without running a second instance of postfix with smtpd_tls_auth_only set to no and then change the webmail software to send mail to that instance instead.

You might consider reconfiguring the webmail to use TLS instead if possible or to deliver mail directly locally instead of using a TCP connection.

share|improve this answer
thanks... mhmhm... can I've an example please? – Pol Hallen Jul 6 '13 at 15:18

stunnel will fix this. It creates an SSL(TLS) connection to postfix:

share|improve this answer
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – slm Oct 25 '13 at 12:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.