I'm trying to get my email server to encrypt the connection between my email server and others. It currently can connect via TLS to itself but it doesn't seem to be able to connect to other servers over encryption.

In postfix main.cf - when forcing the internal encryption by setting:

smtpd_tls_security_level = encrypt

Everything works with internal TLS connections and the emails are delivered to Gmail, Yahoo, etc. But when I try to force the server to server encryption by setting:

smtp_tls_security_level = encrypt

The emails don't get delivered. They are being sent to normal TLS email providers like Gmail, Yahoo, etc. Both have the same cert.

smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/cert.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.example.com/chain.pem

smtp_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtp_tls_cert_file = /etc/letsencrypt/live/mail.example.com/cert.pem
smtp_tls_CAfile = /etc/letsencrypt/live/mail.example.com/chain.pem

What can possibly be the problem?

I'll buy a better certificate if that's necessary but I haven't read that it would be. I've tried with self-signed, Cloudflare TLS, and Let's Encrypt certificates and they all yield the same results.

Could it be something wrong with master.cf? or main.cf?

  • server to server encryption. What server to what server? – 030 Feb 21 '17 at 22:31

When sending server to server, your server becomes the client (smtp_ params).

You can refer to the complete Postfix SMTP Client documentation here.

Regarding your config, smtp_tls_CAfile should point to your trusted certificate store (used to verify the remote servers certificate) and should not be your server's certificate. The trusted certificate store may be in a different location/file depending on the distro used.

smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt

Also, I wouldn't configure any client certificate unless the remote server uses this to authenticate mail submissions. So would remove the smtp_tls_key_file and smtp_tls_cert_file entries. Incorrectly configuring this can cause you to be unable to send mail.

The very least I would put in for the server's TLS client config would be:

smtp_tls_security_level = may
smtp_tls_loglevel = 1

Activate TLS for postfix SMTP client (using the may value will use TLS if the remote server supports it, encrypt will enforce it).

Set the loglevel to 1, allowing you to tell if TLS is being used by producing log entries like:

postfix/smtp[7867]: Trusted TLS connection established to someserver.domain.net[]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

Don't forget to reload or restart postfix.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.