I am getting the following error in the logs for inbound yahoo e-mails:

postfix/smtpd[8679]: SSL_accept error from sonic324-12.consmr.mail.gq1.yahoo.com[]: 0
postfix/smtpd[8679]: warning: TLS library problem: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown:s3_pkt.c:1278:SSL alert number 46:
postfix/smtpd[8679]: lost connection after STARTTLS from sonic324-12.consmr.mail.gq1.yahoo.com[]

It only happens with yahoo and their client reconnects in plaintext. I am on Postfix 2.11.0 and OpenSSL 1.0.2h. I am using a Let's Encrypt certificate.

  • You really should disable SSLv3 completely.
    – Sven
    Jun 1, 2017 at 19:54
  • It already is: smtpd_tls_protocols = !SSLv2, !SSLv3
    – Mart
    Jun 1, 2017 at 20:10
  • Don't you mean smtpd_tls_mandatory_protocols..... Jun 12, 2017 at 3:46
  • Both smtpd_tls_mandatory_protocols and smtpd_tls_protocols are set to !SSLv2, !SSLv3. In this context, we are talking about port 25 and STARTTLS, so smtpd_tls_protocols is relevant.
    – Mart
    Jun 12, 2017 at 13:58
  • @Mart I am on postfix version 3.1.0 and have the same problem. As you mentioned, it's just Yahoo, I see google and many other clients are able to do STARTTLS just fine with my server. Only yahoo fails, and then turns around to connect in 'plain'. Jun 16, 2017 at 22:20

3 Answers 3


For the record, this is absolutely a Yahoo SMTP issue. They fail to implement opportunistic TLS correctly, and shoot themselves in the foot by sending in the clear (without TLS) when WebPKI authentication fails. That makes no sense, sending in the clear is never more secure, and still not authenticated. Yahoo engineers have on a few occasions promised to fix this, but it has not (August 2018) happened as yet.


A root CA chain required to be defined in postfix as SMTP server? I think not true. The whole point of having CAs, is that I can check your server|client cert. with a 3rd party CA or with myself if I have the CA cert. that your server|client cert. is derived from. Yahoo - as SMTP client - has no insights into whatever my postfix has listed as root CA or CA chain. Even if it does gain such insights, what would it learn - that I made my own CA cert. and from that my own server cert.?

Tested by adding my root CA cert. to the miriad of other CA certificates in /etc/ssl/certs, hashing that, and having smtpd_tls_CApath = /etc/ssl/certs in main.cf

Yahoo delivering mail (as client) still fails on STARTTLS, and reverts to clear text mail delivery. Shoot in the foot continues.


This is not a Yahoo SMTP issue. Rather, you need to have a valid certificate and CA chain defined in your Postfix main.cf file.

smtpd_tls_CAfile = /etc/pki/tls/root.crt

Add your root CA chain to this file and restart Postfix.

  • 1
    Or with a letsencrypt cert (like the OP says he is using) just use the fullchain.pem file
    – ivanivan
    Mar 16, 2018 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .