2

I'm trying to set up postfix with TLS.

I've refreshed it by doing the following which removes the defaults so that tls enable-server update the main.cf file and generates certificates:

sudo postconf -X `postconf -nH | egrep '^smtpd(_|_enforce_|_use_)tls'`
sudo postfix tls enable-server
sudo postfix reload

Many instructions I've followed seem to indicate this is all that's required to enable TLS.

When I run the following...

openssl s_client -connect mailhost:25 -starttls smtp

I get the error:

Verification error: self signed certificate

This produces the error from my application:

stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:  
  error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

If I understand it, the enable-server command will generate a self-signed certificate for me and other sources tell me that's what's required.

Is there something I'm misunderstanding about self-signing and postfix? Why am I getting a validation error?

0

1 Answer 1

2

Self-signing certificate means that it is not issued by a publicly trusted certificate authority like Let's Encrypt. This means that the certificate will not be trusted by applications which just trust publicly issued certificates - i.e. most applications. That's why you get this validation error.

2
  • While there are ways to ignore invalid certificates (i.e TLS without validation, which is common in the SMTP+TLS world for the lazy people), you're 100% accurate that 'self signed' certificates will never be trusted by remote applications and such. You may want to mention to OP that if they intend for it to be valid and not trigger that error, they have to get a legitimate SSL certificate for use in their mail server. Jun 23, 2021 at 15:37
  • @ThomasWard: While you are right in general, it is unfortunately nothing known about the use case of the OP. It might be a installation of Postfix to deliver local mails, it might be a company wide server or it might be an internet facing system. What kind of certificate to get and how to get would very much depend on the (unknown) use case though. Jun 23, 2021 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .