Postfix TLS Certificate Warning – Troubleshooting Postfix TLS Certificate Issues

postfix

I have been noticing the following error in my mail.log when Postfix receives an email.

SSL_accept error from domain.example.com [x.x.x.x] -1
warning: TLS library problem: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../ssl/record/rec_layer_s3.c:1528:SSL alert number 46:

I am trying to understand what this means. It looks like there is a problem with a certificate. I believe I have sslv3 turned off in my configuration as it is referenced as !SSLv3. Could the sending entity be trying to use SSLv3? If so, does this mean that the message is not being sent over TLS? I do end up receiving the message regardless of the above error.

Thanks

Edit: Output from the openssl command. Sorry for the screenshots. I couldn't get the block quote to format correctly. Looks like it might not like my self-signed certificate?

Best Answer

I am trying to understand what this means. It looks like there is a problem with a certificate.

Exactly. It means the other system, the one trying to connect to you to transfer mail, does not trust your certificate because it isn't issued by a trusted CA. Some senders don't enforce this -- i.e. may accept a selfsigned cert -- but some do, and you are apparently getting one(s) that do(es). You have already diagnosed this on your own.

Could the sending entity be trying to use SSLv3?

No. The function name ssl3_read_bytes is because the same record format is used for all protocols from SSL3 up including TLS1.0-1.3, and thus the lower-level function first written for SSL3 is reused. (OTOH SSL2 used a different record format that is now completely obsoleted and forgotten.) The error text sslv3 alert certificate unknown is because this alert was first defined in SSL3 and like (nearly all) other alerts carried forward unchanged in higher protocols, whereas some other, newer alerts were added. Neither of these means the SSL3 protocol is being used.

Related Solutions

Linux – How to correct Postfix’ ‘Relay Access Denied’

TLS just enables encryption on the smtp session and doesn't directly affect whether or not Postfix will be allowed to relay a message.

The relaying denied message occurs because the smtpd_recipient_restrictions rules was not matched. One of those conditions must be fulfilled to allow the message to go through:

smtpd_recipient_restrictions =
    permit_sasl_authenticated
    check_recipient_access hash:/etc/postfix/filtered_domains
    permit_mynetworks
    reject_unauth_destination

To explain those rules:

permit_sasl_authenticated

permits authenticated senders through SASL. This will be necessary to authenticate users outside of your network which are normally blocked.

check_recipient_access

This will cause postfix to look in /etc/postfix/filtered_domains for rules based on the recipient address. (Judging by the file name on the file name, it is probably just blocking specific domains... Check to see if gmail.com is listed in there?)

permit_mynetworks

This will permit hosts by IP address that match IP ranges specified in $mynetworks. In the main.cf you posted, $mynetworks was set to 127.0.0.1, so it will only relay emails generated by the server itself.

Based on that configuration, your mail client will need to use SMTP Authentication before being allowed to relay messages. I'm not sure what database SASL is using. That is specified in /usr/lib/sasl2/smtpd.conf Presumably it also uses the same database as your virtual mailboxes, so you should be able enable SMTP authentication in your mail client and be all set.

How to use postfix aliases in cyrus

Go it!

Ok, so when your using fetchmail, you define the "alias" (local user name) in the fetchmail configuration (/etc/fetchmailrc) not in /etc/aliases. Use the smtpname directive.

Example:

set syslog;
set daemon 60;

poll "mail.server.com"
with protocol pop3
user "nrahl@mydomain" password "12345" is "nrahl@localhost"
fetchall
smtpname "nrahl@localhost"

Best Answer

Related Solutions

Linux – How to correct Postfix’ ‘Relay Access Denied’

How to use postfix aliases in cyrus

Related Topic