1

For many years, we've used Postfix on an Ubuntu 12.04 server to send mails via submission of a registration form. This was working as recently as March 2017.

However, suddenly postfix is running into a "certificate verification failed" error (as per mail.log) for many, though not all domains. For example, it is rejecting any mail sent to a gmail address, but will go through to several .edu domains. I checked the SSL certificates to ensure that they are up to date in accordance to some online guides, and that there is a proper ca-bundle.srt file, and that main.cf is pointing to the proper file. All seems to check out. And again, no issues like this before March 2017.

If it helps, an example of the log description for an .edu mail server;

Oct  3 19:20:39 server postfix/pickup[27108]: 7A1BA5E02FB: uid=33 from=<www-data>
Oct  3 19:20:39 server postfix/cleanup[27114]: 7A1BA5E02FB: message-id=<07e5de6389f1ee1f0db978687a2a701c@server>
Oct  3 19:20:39 server postfix/qmgr[27109]: 7A1BA5E02FB: from=<www-data@server>, size=2354, nrcpt=1 (queue active)
Oct  3 19:20:39 server postfix/smtp[27116]: certificate verification failed for mailgateway[ip]:25: untrusted issuer /C=SE/O=AddTrust AB/OU=AddTrust Externa$
Oct  3 19:20:39 server postfix/pickup[27108]: C25FB5E02FC: uid=33 from=<www-data>
Oct  3 19:20:39 server postfix/cleanup[27114]: C25FB5E02FC: message-id=<839ec587b4d3c56ecb8be082fa36e626@server>
Oct  3 19:20:39 server postfix/qmgr[27109]: C25FB5E02FC: from=<www-data@server>, size=2354, nrcpt=1 (queue active)
Oct  3 19:20:40 server postfix/smtp[27116]: 7A1BA5E02FB: to=<email>, relay=mailgateway06[ip]:25, delay=0.62, delays=0.05/0.04/0.22/0.31, dsn=2.$
Oct  3 19:20:40 server postfix/qmgr[27109]: 7A1BA5E02FB: removed
Oct  3 19:20:40 server postfix/smtp[27121]: certificate verification failed for mailgateway04[ip]:25: untrusted issuer /C=SE/O=AddTrust AB/OU=AddTrust Externa$
Oct  3 19:20:41 server postfix/smtp[27121]: C25FB5E02FC: to=<email>, relay=mailgateway04[ip]:25, delay=1.4, delays=0.01/0.02/1/0.35, dsn=2.0.0,$
Oct  3 19:20:41 server postfix/qmgr[27109]: C25FB5E02FC: removed

Or for a google address,

Oct  3 19:00:32 server postfix/pickup[25780]: C0B5E5E02FB: uid=33 from=<www-data>
Oct  3 19:00:32 server postfix/cleanup[25788]: C0B5E5E02FB: message-id=<502b3fe5d32d82faca381ef6f18939f8@server>
Oct  3 19:00:32 server postfix/qmgr[25781]: C0B5E5E02FB: from=<www-data@server>, size=2353, nrcpt=2 (queue active)
Oct  3 19:00:32 server postfix/smtp[25790]: connect to gmail-smtp-in.l.google.com[2607:f8b0:4001:c14::1b]:25: Network is unreachable
Oct  3 19:00:33 server postfix/pickup[25780]: 0542A5E02FC: uid=33 from=<www-data>
Oct  3 19:00:33 server postfix/cleanup[25788]: 0542A5E02FC: message-id=<893ee1fe8af389833686860025d71966@server>
Oct  3 19:00:33 server postfix/qmgr[25781]: 0542A5E02FC: from=<www-data@server>, size=2353, nrcpt=2 (queue active)
Oct  3 19:00:33 server postfix/smtp[25790]: certificate verification failed for gmail-smtp-in.l.google.com[74.125.202.27]:25: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certifi$
Oct  3 19:00:33 server postfix/smtp[25796]: connect to gmail-smtp-in.l.google.com[2607:f8b0:4001:c14::1b]:25: Network is unreachable
Oct  3 19:00:33 server postfix/smtp[25796]: certificate verification failed for gmail-smtp-in.l.google.com[173.194.196.26]:25: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certif$
Oct  3 19:00:34 server postfix/smtp[25796]: 0542A5E02FC: to=<email@GMAIL.COM>, relay=gmail-smtp-in.l.google.com[173.194.196.26]:25, delay=1.1, delays=0.01/0.02/0.11/0.95, dsn=2.0.0$

What could be the cause?

Also if it helps, here is my main.cf file;

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = [SERVER_NAME_OMITTED]
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = [SERVER_NAME_OMITTED], localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,check_policy_service unix:private/policy-spf
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
#content_filter = smtp-amavis:[127.0.0.1]:10024
home_mailbox = Maildir/
mailbox_command =
spf-policyd_time_limit = 3600s

Update: I have also now tried to generate a cacert.pem file as per so many webpages, and set smtp_tls_CAfile and smtpd_tls_CAfile to use that file. This results in a different error (and no mail sent);

Oct  4 01:51:51 server postfix/pickup[6816]: 969E15E02FB: uid=1000 from=<admin>
Oct  4 01:51:51 server postfix/cleanup[6841]: 969E15E02FB: message-id=<20171004015151.969E15E02FB@server>
Oct  4 01:51:51 server postfix/qmgr[6817]: 969E15E02FB: from=<admin@server>, size=291, nrcpt=1 (queue active)
Oct  4 01:51:51 server postfix/smtp[6848]: CA certificate verification failed for gmail-smtp-in.l.google.com[74.125.129.26]:25: num=7:certificate signature failure
Oct  4 01:51:52 server postfix/smtp[6848]: 969E15E02FB: to=<email@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.129.26]:25, delay=0.45, delays=0.06/0.07/$
Oct  4 01:51:52 server postfix/qmgr[6817]: 969E15E02FB: removed
2
  • Does file /etc/ssl/certs/ca-certificates.crt exist? – Egor Vasilyev Oct 4 '17 at 6:13
  • Yes, it does. See extended answer below. – astrosa Oct 4 '17 at 11:30
7

Your Ubuntu is very old. It seems your ca-certificates are out of date.

Your own certificate is not used if you are sending mails. It is only to receive mails with smtpd.

smtp use provided certificates of ca-certificates package for validation. You can try to install a backport to fix up the error in logs.

For example ca-certificates-backport

UPDATE: your config should include smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt

4
  • Main.cf now has both of these lines; smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt And as mentioned below, the ca-certificates.crt file does in fact exist and seems to be accessible fine (it had been all this time and nothing had changed on the infrastructure). So I suspected an out of date issue as well. Unfortunately I can't upgrade Ubuntu at this time, and if I try apt-get update it doesn't work because the package (lucid) is no longer up. So I need a fix for this particular issue (the server will be taken down soon after). – astrosa Oct 4 '17 at 11:36
  • @astrosa its not so difficult as you think. Use any newer Ubuntu or Debian distribution and create a tar of /etc/ssl/certs ( example: tar cfz /tmp/ca-certificates.tgz /etc/ssl/certs ) and overwrite the same directory of your old server ( example: tar xfz ca-certificates.tgz). After executing update-ca-certificates hopefully everything will be fine. But you should not do such things on a server with active update support because some system update will overwrite your changes. – Rainer Oct 4 '17 at 13:21
  • well what I just did was try to download a ca-certificates.crt file from a different and newer server where I can verify that the mailing service is working, and uploaded that to the problematic server. The same result, alas. But I suspect what you're suggesting is different. I'll look into that, thanks. – astrosa Oct 4 '17 at 17:49
  • Thank you I was headdesking so hard trying to get my postfix to verify the TLS cert of my relayhost, until you mentioned smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt which solved my problem! – Marius Gedminas Oct 11 '18 at 18:40
3

You need to type correct path for CA bundle file.

See Postfix TLS Support:

The $smtpd_tls_CAfile contains the CA certificates of one or more trusted CAs. The file is opened (with root privileges) before Postfix enters the optional chroot jail and so need not be accessible from inside the chroot jail.

Pay attention that postfix can run in chroot jail and can't access CA file.

You can type other path inside Postfix directory, for example (in my infrastructure):

smtpd_tls_CAfile = /var/spool/postfix/etc/ssl/certs/ca-certificates.crt

Does file /etc/ssl/certs/ca-certificates.crt exist?

If you cannot find CA files and don't know where it placed you can use this command to find all CA similar files:

find / \( -name "*.crt" -o -name "*.ca-bundle" -o -name "*.pem" \) -type f -size +100k

I use approach that CA file have size greather than 100Kb (my file is about 270Kb)

Or you can find all cert files and sort it by size and get only first 10 lines of output find command:

find / \( -name "*.crt" -o -name "*.ca-bundle" -o -name "*.pem" \) -type f -exec du -sh {} \; | sort -r -h | head
1
  • Yes, the file /etc/ssl/certs/ca-certificates.crt exists, and the path is correctly typed in the main.ch file. This ca-certficiates.crt file is about 255Kb on my end. It had been working all this time using this file, but I disabled the chroot in master.ch just to be sure. It had no effect. I also tried to generate a cacert.pem file via some online guides targeting google smtp, but it did not work either. Same validation message. – astrosa Oct 4 '17 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.