0

I have postfix running on mail.myserver.com for the past 15+ years, successfully receiving and sending mail. All certs are fully valid using Let's Encrypt. I can verify that they are fine using openssl s_client -connect mail.myserver.com:25 -starttls smtp to validate STARTTLS and similar tests for SSL on port 465.

I say that all to establish that this is not a new setup and except for this one singular instance, everything appears to be setup correctly and running smoothly.

Given all that, I find myself unable to receive email from a specific vendor (my health provider!). Looking through the postfix logs, I see lines like so:

postfix/smtpd[2016]: connect from mail1.static.mydoctor.com[xxx.xx.xx.xxx]
postfix/smtpd[2016]: SSL_accept error from mail1.static.mydoctor.com[xxx.xx.xx.xxx]: 0
postfix/smtpd[2016]: warning: TLS library problem: 2016:error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:s3_pkt.c:1493:SSL alert number 42:
postfix/smtpd[2016]: lost connection after STARTTLS from mail1.static.mydoctor.com[xxx.xx.xx.xxx]
postfix/smtpd[2016]: disconnect from mail1.static.mydoctor.com[xxx.xx.xx.xxx]

This is telling me that the mail1.static.mydoctor.com mail server is attempting to connect to my mail.myserver.com via STARTTLS but offers up a bad certificate and so my postfix rejects the connection. Do let me know if my interpretation of that is incorrect!

I really do need to receive those specific emails, even if the sender is doing it wrong. What kind of workaround might work in this case? Is there a way to maybe relax the cert checking to allow the bad cert anyway? Or maybe whitelist that specific remote server such that anything it sends is accepted? Something else?

1 Answer 1

3
... sslv3 alert bad certificate:s3_pkt.c:1493:SSL alert number 42:

This is telling me that the mail1.static.mydoctor.com mail server is attempting to connect to my mail.myserver.com via STARTTLS but offers up a bad certificate and so my postfix rejects the connection.

This is the wrong interpretation. The "alert bad certificate" in your log means that your server has received this alert from the sender MTA, because the sender MTA could not validate your certificate. I.e. it is not about the sender providing the wrong certificate, but your server providing a certificate which the sender will not accept.

It is unclear why the sender MTA was not able to verify your certificate. It might be a setup problem in your part or a setup problem at the sender.

1
  • Thank you! Knowing that it was my fault prompted me to dive even deeper into this rabbit hole. It turns out that my certs were fine but my DNS MX settings were not! I had "MX 10 myserver.com" and some cert validators expected "MX 10 mail.myserver.com" (plus mail.myserver.com needed to be an A record, not a CNAME) Commented Jan 21 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .