4

I've set up a server with postfix for sending mails. However, when I try to send an email to a gmail account, I get the following errors:

May 16 23:41:47 vps4195 postfix/smtp[15949]: certificate verification failed for gmail-smtp-in.l.google.com: num=20:unable to get local issuer certificate
May 16 23:41:47 vps4195 postfix/smtp[15949]: certificate verification failed for gmail-smtp-in.l.google.com: num=27:certificate not trusted

After these errors the mail is delivered to the gmail accounts, but the mail will almost always go to the spam directory, even when no mail filter is used inside gmail.

So how can I get rid of these errors?

ps. Probably this isn't enough information for you to help me fix this, but I'm not really an expert on this subject, so please tell me if I need to post more information.

edit: The system postfix is running on is CentOS 5.5 (VPS)

2 Answers 2

5

These two errors are unrelated.

  • The first is an indication that you don't have installed the necessary root certificates to reliable check the identity of Google's servers, but are nevertheless trying to use SSL encrypted SMTP. You have two options, the first being to deactivate SSL for mail delivery, which is IMHO an acceptable solution if you don't use Google's server as a mail relay. The second would be to install the certificate chain for Google's servers, or even better a full stack of SSL root certificates and tell Postfix where to find them. How this is done is a little bit dependent on the system you are using Postfix on, which you don't name.
  • The second error is an indication that your mail system is badly configured and Google's spam filter just consider mails from your system as spam. This might have multiple reasons, among them that you might be an open relay, that your DNS entries are incorrect or you might listed in some DNSBL lists (for being an open relay or for sending out spam). You will find a multitude of questions on ServerFault that deals with those topics.
1
  • thanks for your answer! Can you also tell me where I can find those SSL root certificates? As for the second error, how can I find out which one is the problem? Or should I just try some solutions to see if they work? (btw, I'm quite sure the server isn't an open relay and that the DNS is correct)
    – Tiddo
    May 17, 2011 at 7:56
1

Google switched the Certificate to Equifax.

You can download the certificate from: https://www.geotrust.com/resources/root-certificates/index.html (download the Root 1 - Equifax Secure Certificate Authority as DER encoded X.509)

After downloading it you have to convert it to a pem:

openssl x509 -inform der -in Equifax_Secure_Certificate_Authority_DER.cer -out Equifax_Secure_Certificate_Authority_DER.pem

Now you can verfiy the certificate:

openssl verify Equifax_Secure_Certificate_Authority_DER.pem

Last you have to add the pem to your certificate folder. In Debian this is /etc/ssl/certs

I also added it to /etc/ssl/certs/ca-certificates.crt with

cat Equifac_Secure_Certificate_Authority_DER.pem >> /etc/ssl/certs/ca-certificates.crt

and include this crt in my postfix configuration:

smtpd_tls_CAfile=/etc/ssl/certs/ca-certificates.crt
smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .