4

I have been tasked with setting up a Postfix server running on Ubuntu. Emails are sending through my relay and all seems well except for the fact that I cannot seem to get TLS to work with Gmail or other mail clients. For example, please see the TLS output of my main.cf file:

# TLS parameters

smtpd_tls_cert_file=/etc/ssl/certs/company.com.crt
smtpd_tls_key_file=/etc/ssl/private/company.com.key
smtpd_tls_CAfile=/etc/ssl/certs/gd_bundle.crt
smtp_tls_CApath=/etc/ssl/certs
smtpd_use_tls=yes
smtpd_tls_auth_only=yes
smtpd_tls_security_level=may
smtp_tls_security_level=may
smtp_tls_loglevel=1
smtpd_tls_loglevel=1
smtp_tls_note_starttls_offer=yes
smtpd_tls_session_cache_database=btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database=btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

I have done the following through Telnet to verify STARTTLS:

Connected to localhost.
Escape character is '^]'.
220 prod-email.company.local ESMTP Postfix (Ubuntu)
EHLO localhost
250-prod-email.company.local
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 SMTPUTF8
STARTTLS
220 2.0.0 Ready to start TLS

I also see TLS establishing connections to many other relay/exchange servers in the logs (there are many more than these examples):

Nov  2 11:08:58 prod-email postfix/smtp[7864]: Trusted TLS connection established to mx2-us1.ppe-hosted.com[67.231.154.163]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Nov  2 11:22:23 prod-email postfix/smtp[8672]: Trusted TLS connection established to mail.relaissanmaurizio.it[194.209.228.112]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Nov  2 11:22:25 prod-email postfix/smtp[8689]: Trusted TLS connection established to mail.relaissanmaurizio.it[194.209.228.112]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Nov  2 11:31:06 prod-email postfix/smtp[8676]: Trusted TLS connection established to mx1-us1.ppe-hosted.com[148.163.129.50]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Nov  2 11:51:13 prod-email postfix/smtp[9165]: Trusted TLS connection established to mail.relaissanmaurizio.it[194.209.228.112]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Nov  2 11:51:15 prod-email postfix/smtp[9229]: Trusted TLS connection established to mail.relaissanmaurizio.it[194.209.228.112]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

I am also seeing these strange logs in /var/log/mail.log for a particular customer:

454 4.7.0 Connection is not TLS encrypted. Recipient organization requires TLS.

How is this possible when it seems that I am offering TLS to be used on outgoing emails? At least it looks this way according to the above logs (TLS Connection Established).

My question is, why do I not see these TLS connections being established with Gmail's servers or the server in the example above? I still receive the little red padlock on received Gmails sent through this relay server saying it is not being encypted. And some of my mail is being deferred because it is saying that the connection is not TLS encrypted?

How can I verify that TLS is working correctly and that all outgoing emails are being encrypted with TLS to those that accept the TLS protocol?

Anyone's help is greatly appreciated.

Best Regards

EDIT:

 openssl s_client -connect localhost:25 -starttls smtp

 STARTTLS
 554 5.5.1 Error: TLS already active

Gives me no errors regarding my certificates.

Email headers for Gmail and Outlook also do not show TLS encryption.

I am at a loss...

UPDATE: I just attempted to get this working by updating the certificates being used (wildcard cert was expiring in December anyway), and TLS is still not working properly. Please help.

UPDATE: I also attempted to force TLS for gmail and got the following error:

TLS is required, but was not offered by host alt1.gmail-smtp-in.l.google.com[74.125.192.27]

Why wouldn't google offer TLS? I am confused...

  • 3
    Have you tried checking your TLS using a testing service such as checktls.com If so, what does this show? – J Smith Nov 7 '17 at 18:50
  • I'm having this same problem, and I did try checktls.com and it said I am using TLs. I am trying to force TLS with gmail. Did you ever get it working, and how? – felwithe Aug 19 '18 at 1:41
  • Greetings @felwithe. The server I was attempting to implement TLS on was located behind a Cisco ASAX firewall. We were utilizing the ESMTP inspect rule on this firewall. If I remember correctly, removing this rule from our global policy seemed to have corrected the issue for us as the firewall did not like the TLS traffic when this rule was enabled. Once this rule was removed GMAIL was happy with the encryption so it seemed to have resolved our issue. I hope this helps! – MotoDave452 Aug 20 '18 at 15:13
3

Are you sitting behind a firewall?

If so, check if you are using the ESMTP inspect rule. Removing this rule from global_policy may help.

  • 2
    This seems to have done the trick! Thank you so much! It seems that this rule on our ASA did not like the encrypted traffic. – MotoDave452 Nov 22 '17 at 18:39
2

I compared your Postfix configuration with a working configuration, and noticed that your configuration is missing smtp_use_tls = yes.

According to this postfix mailing list post, smtp_* entries apply to your SMTP server as a sender, while entries starting smtpd_* apply to your SMTP server as a recipient. It seems that your problems are restricted to your SMTP server as a sender.

I also found this Postfix documentation, which states that smtp_use_tls is set to "no" by default.

So I'd suggest setting smtp_use_tls = yes, and see if that does anything. If not, perhaps other smtp_* settings might be the problem.

EDIT: smtp_use_tls should be overridden by smtp_tls_security_level in newer versions of Postfix. I notice you didn't mention your Postfix version, but this will probably only help if it's older than 2.3.

  • I will attempt to use 'smtp_use_tls = yes' in my configuration. I thought that this was deprecated and replaced by 'smtp_tls_security_level=may' which I have included but I will give it a try. I am running Postfix version 3.1.0. I will keep you updated, thank you! – MotoDave452 Nov 8 '17 at 20:41
  • I attempted to add 'smtp_use_tls = yes' however this does not change anything. I agree with you when you say 'It seems that your problems are restricted to your SMTP server as a sender.' Any additional ideas? – MotoDave452 Nov 10 '17 at 14:57
  • I am open to any additional advice you may have. I just attempted to get this working by updating the certificates being used (wildcard cert was expiring in December anyway), and TLS is still not working properly. – MotoDave452 Nov 21 '17 at 14:57
1

Removing ESMTP from Cisco firewall Global policy fixed it for us. ESMTP comes default enabled in Cisco firewall.

  • This is rather a comment than an answer. Please gain more reputation and you'll be able to use comments. – bgtvfr Jul 30 '18 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.