I'm working on an Ubuntu server hosting multiple websites for one company. Trying to get one of the domains to be PCI compliant, but it's failing on port 25 (SMTP) because the SSL certificate hostname doesn't match.

Each domain hosted on the server has its own valid SSL certificate, or some share multi-domain certificates. The PCI scan validates the SSL certificate on port 443.

The mail server is Postfix, and the main.cf config uses a valid wildcard SSL certificate that is used for the "main" domain of the company. The domain I'm trying to validate for PCI is another domain.

I don't really understand how this could be set up to use a SSL certificate on port 25 which will be valid for any domain hosted on this server that needs to pass PCI. This is slightly outside my areas of knowledge at the moment.


www.pci.domain - The domain I'm trying to make PCI compliant (not actual name obviously).

  • Has its own valid certificate /etc/apache2/ssl/certs/other.domain.crt
  • Incoming mail goes to Microsoft Outlook via DNS: MX 10 pci.domain.mail.protection (not sure if this is relevant).

www.other.domain - The company's "main" domain.

  • Has its own valid wildcard certificate /etc/apache2/ssl/certs/other.domain.wildcard.crt

Postfix uses the certificate of other.domain at the moment, which is obviously not valid for pci.domain or any other domains when the PCI scan tries to verify that port 25 is secure for those other domains.

  • Why is incoming mail being handled in your cardholder data environment? Move that mail server somewhere else. – Michael Hampton Dec 21 '18 at 17:29
  • @MichaelHampton I don't know, that's just how it is currently set up. Incoming mail is routed to Microsoft's Outlook server. Can you elaborate? I don't understand mail particularly well, I have never set up SMTP. – BadHorsie Dec 21 '18 at 17:32
  • Why is there a Postfix mail server running on this machine accepting incoming mail to begin with, if the mail is supposed to be going to O365? And if the machine is supposed to be handling cardholder data. – Michael Hampton Dec 21 '18 at 17:35
  • @MichaelHampton I'm not sure, maybe used for server admin mailboxes or something? To clarify, the mailboxes associated with the website(s) are at Outlook. I mean, even if the server needs its own mail server, is this not PCI compliant? If I stop Postfix, the SSL scan will just say the server does not have SSL/TLS encryption on port 25. – BadHorsie Dec 21 '18 at 17:40
  • If you stop Postfix, there won't be anything listening on port 25, which is what I would expect to see. You need to go find out why there is a mail server running on this machine accepting incoming mail before you go further. – Michael Hampton Dec 21 '18 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.