Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in the middle of setting up a postfix server on Arch Linux. It seems to be working ok so far - I can successfully speak to it via telnet localhost 25. However, when I try to connect using openssl's s_client, it complains:

$ openssl s_client -connect localhost:25
140243743024808:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:766:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 7 bytes and written 228 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

and exits with status 1.

Relevant part of /etc/postfix/

smtpd_tls_key_file = /path/to/server.key.pem
smtpd_tls_cert_file = /path/to/server.crt.pem
smtpd_tls_CAfile = /path/to/ca.pem

smtpd_tls_security_level = may

I also have the key and cert in non-pem formats, and they are working fine with another service that uses them (an xmpp server).

I have found documentation saying that to achieve this, I need to uncomment a line in /etc/postfix/ and use port 587 instead of 25. This gives me the same outfrom from openssl s_client as above.

How do I convince postfix to use TLS?

share|improve this question
up vote 2 down vote accepted

You do not need to use port 587 for tls, because it is application protocol independent.

I get exactly the same result as you from openssl s_client -connect localhost:25, but tls is working properly on my server.

Currently i have no access to my personal wiki, so i couldn't paste the correct command to check your tls configuration on your system. But you could use CheckTLS.

share|improve this answer

I suggest you to read about STARTTLS. It comes down to this: start an unencrypted plain text connection and upgrade to TLS later. The openssl command does not use this and wants to do an SSL/TLS handshake directly.

The 'general' de facto configuration for MTAs is to configure it to have STARTTLS available on port 587, plain SSL/TLS on 465 and insecure with STARTTLS option on port 25. This is no standard as far as I know, just the way major service providers seem to do it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.