I am in the middle of setting up a postfix server on Arch Linux. It seems to be working ok so far - I can successfully speak to it via
telnet localhost 25. However, when I try to connect using openssl's
s_client, it complains:
$ openssl s_client -connect localhost:25 CONNECTED(00000003) 140243743024808:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:766: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 228 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE ---
and exits with status 1.
Relevant part of
smtpd_tls_key_file = /path/to/server.key.pem smtpd_tls_cert_file = /path/to/server.crt.pem smtpd_tls_CAfile = /path/to/ca.pem smtpd_tls_security_level = may
I also have the key and cert in non-pem formats, and they are working fine with another service that uses them (an xmpp server).
I have found documentation saying that to achieve this, I need to uncomment a line in
/etc/postfix/main.cf and use port 587 instead of 25. This gives me the same outfrom from
openssl s_client as above.
How do I convince postfix to use TLS?