Search code examples
sslsmtpcertificatelocal

does os based certificates (ca-bundle.crt) work fine using smtp_tls_CAfile

Is it compulsory to use:

  1. smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt

While I'm also using:

  1. smtp_tls_cert_file=/etc/letsencrypt/live/videoshark.io/fullchain.pem
  2. smtp_tls_key_file=/etc/letsencrypt/live/videoshark.io/privkey.pem

I mean whats the difference in both?

This is the error Im seeing when I RUN: tail /var/log/maillog postfix/smtpd[1419]: fatal: open lock file pid/inet.smtp: cannot open file: Permission denied

I just want postfix to be configured with gmail relay service using SSL/TLS Appreciate the help!

Solution

  • smtp_tls_cert_file and smtp_tls_key_file are to specify the local certificate, i.e. the one which gets provided to the SMTP client inside the TLS handshake. This is therefore needed if you want to accept TLS traffic.

    smtp_tls_CAfile is to verify the certificate Postfix gets when communicating with another mail server. This is therefore needed if you want it to be able to use TLS when sending mail to other servers.