Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in the middle of setting up a postfix server on Arch Linux. It seems to be working ok so far - I can successfully speak to it via telnet localhost 25. However, when I try to connect using openssl's s_client, it complains:

$ openssl s_client -connect localhost:25
140243743024808:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:766:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 7 bytes and written 228 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

and exits with status 1.

Relevant part of /etc/postfix/

smtpd_tls_key_file = /path/to/server.key.pem
smtpd_tls_cert_file = /path/to/server.crt.pem
smtpd_tls_CAfile = /path/to/ca.pem

smtpd_tls_security_level = may

I also have the key and cert in non-pem formats, and they are working fine with another service that uses them (an xmpp server).

I have found documentation saying that to achieve this, I need to uncomment a line in /etc/postfix/ and use port 587 instead of 25. This gives me the same outfrom from openssl s_client as above.

How do I convince postfix to use TLS?

share|improve this question
up vote 2 down vote accepted

You do not need to use port 587 for tls, because it is application protocol independent.

I get exactly the same result as you from openssl s_client -connect localhost:25, but tls is working properly on my server.

Currently i have no access to my personal wiki, so i couldn't paste the correct command to check your tls configuration on your system. But you could use CheckTLS.

share|improve this answer

I suggest you to read about STARTTLS. It comes down to this: start an unencrypted plain text connection and upgrade to TLS later. The openssl command does not use this and wants to do an SSL/TLS handshake directly.

The 'general' de facto configuration for MTAs is to configure it to have STARTTLS available on port 587, plain SSL/TLS on 465 and insecure with STARTTLS option on port 25. This is no standard as far as I know, just the way major service providers seem to do it.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .