5

I use Postfix in combination with Lets Encrypt to transmit TLS encrypted e-mails.

The following parameters in /etc/postfix/main.cf are relevant:

smtp_tls_key_file = /etc/letsencrypt/live/foo.bar/privkey.pem
smtp_tls_cert_file = /etc/letsencrypt/live/foo.bar/fullchain.pem
smtp_tls_CAfile = /etc/letsencrypt/live/foo.bar/fullchain.pem

I can send e-mails without problems, but I get the warning message that Postfix cannot verify the certificate of the receiving site:

postfix/smtp[10736]: Untrusted TLS connection established to example.com[xxx.xxx.xxx.xxx]:25: TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)

I suspect this is because Postfix is not able to access its certificate store with this parameter:

smtp_tls_CAfile = /etc/letsencrypt/live/foo.bar/fullchain.pem

A change to smtp_tls_CAfile = /etc/ssl/certs will break my entire TLS-Configuration.

What do I have to configure so that Postfix is able to send encrypted messages via Lets Encrypt and to check the certificate on the recipient side?

2 Answers 2

12

Solved. The issue was missing CA-Certificates on my system. So Postfix was not able to verify the Issuer of the Client.

Solved by installing

sudo apt install ca-certificates -y

Then pointing Postfix to the new installed CA-Certificates:

sudo postconf -e 'smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt'
sudo postfix reload

Result:

tail -f /var/log/mail.log
postfix/smtp[11023]: Trusted TLS connection established to ...
0

This fixed my problem in Postfix for RHEL 8.7

I was seeing this error on gmail.com, hotmail.com, outlook.com connections as being untrusted TLS.

First I made sure the ca-certificate was installed I typed: sudo yum install ca-certificates Once it says it was already installed I edited the main.cf sudo nano /etc/postfix/main.cf searched for the smtp_TLS_CA line commented out my old line with a # and made a note in case I need to reverse it then added a new line: smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt saved file did a restart of the postfix service. systemctl restart postfix checked for errors: systemctl status postfix then did a test email to a gmail.com user and made sure the log showed it was a trusted TLS connection. Fixed!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .