Administrace komentářů

Dobrý den,

řeším problém s certifikátem. StartTLS funguje, respektive thunderbird ho najde, ale TLS port 465 ne a ne. Linux server 3.11-2-amd64 #1 SMP Debian 3.11.10-1 (2013-12-04) x86_64 GNU/Linux

mail.info

Dec 15 12:58:24 server dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.2.2, lip=192.168.2.5, TLS: SSL_read() syscall failed: Connection$
Dec 15 13:03:58 server postfix/smtps/smtpd[22816]: initializing the server-side TLS engine
Dec 15 13:03:58 server postfix/smtps/smtpd[22816]: connect from localhost[127.0.0.1]
Dec 15 13:03:58 server postfix/smtps/smtpd[22816]: setting up TLS connection from localhost[127.0.0.1]
Dec 15 13:03:58 server postfix/smtps/smtpd[22816]: localhost[127.0.0.1]: TLS cipher list "aNULL:-aNULL:ALL:!EXPORT:!LOW:+RC4:@STRENGTH:!aNULL"
Dec 15 13:03:58 server postfix/smtps/smtpd[22816]: SSL_accept:before/accept initialization
Dec 15 13:04:59 server postfix/smtps/smtpd[22816]: SSL_accept:error in unknown state
Dec 15 13:04:59 server postfix/smtps/smtpd[22816]: SSL_accept error from localhost[127.0.0.1]: -1
Dec 15 13:04:59 server postfix/smtps/smtpd[22816]: warning: TLS library problem: 22816:error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:628:
Dec 15 13:04:59 server postfix/smtps/smtpd[22816]: lost connection after CONNECT from localhost[127.0.0.1]
Dec 15 13:04:59 server postfix/smtps/smtpd[22816]: disconnect from localhost[127.0.0.1]
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: connect from unknown[192.168.2.2]
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: setting up TLS connection from unknown[192.168.2.2]
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: unknown[192.168.2.2]: TLS cipher list "aNULL:-aNULL:ALL:!EXPORT:!LOW:+RC4:@STRENGTH:!aNULL"
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:before/accept initialization
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:SSLv3 read client hello A
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:SSLv3 write server hello A
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:SSLv3 write certificate A
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:SSLv3 write key exchange A
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:SSLv3 write certificate request A
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:SSLv3 flush data
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL3 alert read:fatal:unknown CA
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept:failed in SSLv3 read client certificate A
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: SSL_accept error from unknown[192.168.2.2]: 0
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: warning: TLS library problem: 22816:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1256:SSL $
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: lost connection after CONNECT from unknown[192.168.2.2]
Dec 15 13:05:57 server postfix/smtps/smtpd[22816]: disconnect from unknown[192.168.2.2]

master.cf

smtp      inet  n       -       -       -       -       smtpd
#smtp      inet  n       -       -       -       1       postscreen
#smtpd     pass  -       -       -       -       -       smtpd
#dnsblog   unix  -       -       -       -       0       dnsblog
#tlsproxy  unix  -       -       -       -       0       tlsproxy
#submission inet n       -       -       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING

main.cf smtp sekce

smtp_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtp_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtp_tls_key_file = /etc/postfix/ssl/smtpd.key
smtp_tls_loglevel = 2
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_session_cache_timeout = 3600s
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
smtpd_milters = inet:localhost:12345
smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023 permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = cyrus
smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_tls_loglevel = 2
smtpd_tls_received_header = yes
smtpd_tls_req_ccert = yes
smtpd_tls_security_level = encrypt
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom