Search code examples
sendmailpostfix-mtastarttls

Postfix StartTLS Verify=Fail


I started to notice these errors in my mail log this morning. I'm not sure how long it's been an issue, but I'm hoping someone here can help me fix it.

Any time mail is being sent from my server, these show up:

Jan  3 00:02:27 localhost sendmail[35620]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1.2, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256
Jan  3 01:07:13 localhost sendmail[37987]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1.2, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256
Jan  3 01:30:04 localhost sendmail[39139]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1.2, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256

Here is an full example :

Jan  3 11:08:20 localhost sendmail[60377]: u03J3a3G060377: from=ken, size=656, class=0, nrcpts=1, msgid=<201601031903.u03J3a3G060377@localhost.my.domain>, relay=ken@localhost
Jan  3 11:08:20 localhost postfix/smtpd[60546]: connect from localhost[127.0.0.1]
Jan  3 11:08:20 localhost sendmail[60377]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1.2, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256
Jan  3 11:08:20 localhost postfix/smtpd[60546]: 3A204449893: client=localhost[127.0.0.1]
Jan  3 11:08:20 localhost postfix/cleanup[60549]: 3A204449893: message-id=<201601031903.u03J3a3G060377@localhost.my.domain>
Jan  3 11:08:20 localhost sendmail[60377]: u03J3a3G060377: to=ken@****.com, ctladdr=ken (1001/1001), delay=00:04:44, xdelay=00:00:00, mailer=relay, pri=30656, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (Ok: queued as 3A204449893)
Jan  3 11:08:20 localhost postfix/qmgr[27479]: 3A204449893: from=<ken@localhost.my.domain>, size=1293, nrcpt=1 (queue active)
Jan  3 11:08:20 localhost postfix/smtpd[60546]: disconnect from localhost[127.0.0.1]
Jan  3 11:08:20 localhost postfix/smtp[60550]: 3A204449893: to=<ken****@gmail.com>, orig_to=<ken@****.com>, relay=gmail-smtp-in.l.google.com[173.194.199.26]:25, delay=0.43, delays=0.11/0.01/0.11/0.19, dsn=2.0.0, status=sent (250 2.0.0 OK 1451848101 t1si22729840oem.51 - gsmtp)
Jan  3 11:08:20 localhost postfix/qmgr[27479]: 3A204449893: removed

My SSL certificate is not 'self signed' and was purchased from namecheap.com - this certificate is also being used on my webserver and working without issues.

I'm using Postfix v2.11 on FreeBSD 10.2. Also, are those "sendmail" lines a part of Postfix? I've disabled sendmail using this guide: https://www.freebsd.org/doc/handbook/mail-changingmta.html

Any ideas what could be causing the issue?


Solution

  • It appears something I installed reverted the /etc/mail/mailer.conf file back to defaults (to use sendmail).

    If you use postfix, that file should only contain these lines :

    # Execute the Postfix sendmail program, named /usr/local/sbin/sendmail
    sendmail        /usr/local/sbin/sendmail
    send-mail       /usr/local/sbin/sendmail
    mailq           /usr/local/sbin/sendmail
    newaliases      /usr/local/sbin/sendmail
    

    To ensure this does not happen again, edit your /etc/make.conf file and add :

    NO_SENDMAIL=true
    

    To disable sendmail specific tasks, edit your /etc/periodic.conf file and add :

    daily_clean_hoststat_enable="NO"
    daily_status_mail_rejects_enable="NO"
    daily_status_include_submit_mailq="NO"
    daily_submit_queuerun="NO"
    

    To prevent sendmail from starting on boot, edit your /etc/rc.conf file and add :

    sendmail_enable="NO"
    sendmail_submit_enable="NO"
    sendmail_outbound_enable="NO"
    sendmail_msp_queue_enable="NO"