make postfix reject invalid TLS certs on receiving

muekno · Nov 21, 2024

Sorry may be a silli question but im searching the internet now for nearly two hours without success
I like to configure my postfix so that incoming mails are rejected if the TLS cert is invalid i.e. selfsinged etc.

Thanks for any hint

Regards
Rainer

till · Nov 21, 2024

From ChatGPT:

To configure Postfix on Linux to reject incoming connections when the SSL certificate presented by the client is invalid or self-signed, you need to set up mutual TLS authentication (also known as TLS client authentication). This involves configuring Postfix's SMTP server (smtpd) to request and require a valid client certificate during the TLS handshake.

Here's how to achieve this:

Enable TLS for Incoming Connections: Ensure that TLS is enabled for incoming connections.

smtpd_tls_security_level = encrypt

This setting in your main.cf file forces all SMTP connections to use TLS encryption.

Request Client Certificates: Configure Postfix to ask for client certificates.

smtpd_tls_ask_ccert = yes

This setting tells Postfix to request a certificate from the client during the TLS handshake.

Require Valid Client Certificates: Instruct Postfix to require a valid client certificate, rejecting connections without one.

smtpd_tls_req_ccert = yes

With this setting, Postfix will only accept connections from clients that present a certificate signed by a trusted Certificate Authority (CA).

Specify Trusted CAs: Provide the path to the CA certificates that Postfix should use to verify client certificates.

smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

Replace /etc/ssl/certs/ca-certificates.crt with the path to your trusted CA bundle. This file should contain all the CA certificates that you trust to sign client certificates.

Optional - Verify Client Hostnames: You can enforce hostname verification to ensure the client's certificate matches its hostname.

smtpd_tls_verify_cert_match = hostname

Reload Postfix Configuration: After making these changes, reload Postfix to apply the new settings.

sudo systemctl reload postfix

Example Configuration Snippet in main.cf:

smtpd_tls_security_level = encrypt
smtpd_tls_ask_ccert = yes
smtpd_tls_req_ccert = yes
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_verify_cert_match = hostname

Notes:

Trusted CAs: Ensure that the CA certificates specified are up-to-date and include all the authorities you trust. Self-signed certificates or certificates signed by untrusted CAs will be rejected.

Client Configuration: Clients connecting to your Postfix server must present a valid certificate signed by a trusted CA. Ensure that legitimate clients are configured accordingly.

Testing: Before deploying these settings in a production environment, test the configuration with a client presenting both valid and invalid certificates to confirm that Postfix behaves as expected.

Additional Resources:

Postfix TLS Support

Postfix Configuration Parameters

By following these steps, Postfix will reject incoming connections when the client presents an invalid or self-signed SSL certificate.
Click to expand...

muekno · Nov 21, 2024

Thank you
Regards
Rainer

Log in or Sign up

make postfix reject invalid TLS certs on receiving

muekno Active Member HowtoForge Supporter

till Super Moderator Staff Member ISPConfig Developer

muekno Active Member HowtoForge Supporter

Share This Page

Log in or Sign up

make postfix reject invalid TLS certs on receiving

muekno Active Member HowtoForge Supporter

till Super Moderator Staff Member ISPConfig Developer

muekno Active Member HowtoForge Supporter

Share This Page

Useful Searches