I've got an Ubuntu 14.04 server running Postfix - which is sending mail via an external host (Mandrill).

I've got no issues sending email - but (prior to disabling TLS - which seems to have caused no issue) - on each email sent I'd get the error -

postfix/postfix-script[4557]: warning: /var/spool/postfix/etc/ssl/certs/ca-certificates.crt and /etc/ssl/certs/ca-certificates.crt differ

Since disabling TLS I no longer get the warning when sending an email (not supprising) - however it's seen on starting the service (and on scheduled cron service checks).

The server hosts multiple domains - but only sends emails from one.

The obvious solution it seems would be to copy over the certificate files to the Postfix directory (would love a reminded on which files other than the .crt I need to move!)?

Or is this a warning I don't really need to worry about?

Any help much appreciated.


  • womble below has now offer a great in-depth explanation. – Richard Crosby Sep 6 '15 at 4:02

You don't really need to worry about it, for several reasons.

  1. The proximate cause of the log message is that various parts of Postfix run chrooted under /var/spool/postfix, and so those parts will look in /var/spool/postfix/etc/ssl/certs/ca-certificates.crt to get list of TLS trust anchors used to validate certificates presented. In theory, an out-of-date ca-certificates.crt could mean that those chrooted parts of Postfix might not recognise a "valid" certificate as such, or fail to distrust a certificate issued by a since-detrusted CA. In practice, the list of trusted roots changes so infrequently that it's unlikely to be a problem.

  2. SMTP-over-TLS is not like HTTPS, with regards to the trustworthiness of certificates. Practically no SMTP server running on the Internet today checks that the certificates that are presented are trustworthy, because so many certificates fail validation -- either because of name mismatches, expiration, or issuance by an untrusted CA (usually self-signed, but not always). SMTP operators, in general, are of the opinion that passive attackers are of greater concern than active attackers, so encryption to an untrusted endpoint is better than not encrypting (which is what would automatically happen if the TLS-protected connection was rejected).

Yes, the obvious solution is to copy over the file that is being complained about, into the chroot. There's no other files to copy, because it isn't Postfix's own key/cert pair you're copying, it's only the list of trust anchors, which are all contained in a single file.

  • Much appreciated! On a bit of a sys log trawl and that was of the last issues on my list! – Richard Crosby Sep 6 '15 at 4:00
  • 1
    The SMTP operator opinion in point 2 is of course backed by the fact that they cannot influence if the next hop will be (or the previous hop was) also very restrictive with certificate failures (or uses TLS at all) – Hagen von Eitzen Sep 6 '15 at 6:54
  • That's a good point, too, Hagen. – womble Sep 6 '15 at 22:07
  • Restarting postfix copies over the files by itself, which is IMO recommended, since manual copies are error prone. – Braiam Mar 3 '16 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.