Enabling (and maybe requiring) SSL/TLS for SMTP server?

You need to do three things to use SSL with Postfix. First, edit /etc/postfix/master.cf and remove the comments ("#") from the "smtps" line and following -o lines. Then, upload your certificate and key to a location of your choice, in this example /etc/postfix/mycert. Then, edit /etc/postfix/main.cf and add/uncomment these lines:

smtpd_tls_cert_file = /etc/postfix/mycert.crt
smtpd_tls_key_file = /etc/postfix/mycert.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Requiring SMTPS is not a good idea, because remote mailservers will always try to deliver non-SSL on port 25 when they have mail for you. Except you run a mailserver only for your local users to send out mail. In that case, it'd be easiest to block access to port 25.

Ah, it seems SMTPS is already enabled on your system in the master.cf but is missing some parameters. I'll post what the block looks like on my system, if you have problems you can change it like so:

smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Actually I'm not sure if those lines starting with "-o" need to be on separate lines. It's possible that you can leave it like it is for you now, if those lines contain the same things on your system, just without linebreaks. You might wanna make the other changes and see if it works. :)

I'm not sure if the "Copy to Postfix" button does the full SSL config bits for you if the required directives are not in the config files yet, or if it just copies the certificate files. You can try that out, and compare what Webmin does for you with the lines I posted.

Okidoki, great that it's working for you!

Hello,

I've got the same problem and can't get it to work.

The beginning of the master.cf :

Is there something wrong?

I copied the certificate by the button "copy to postfix". The cert files are in the correct directory as set in my main.cf :

Has anyone an idea?

Do you have wildcard SSL? If not then you must buy one in order to work. Please next time open a new topic as there is no point in necroing 3 year old topic.

Check if this helps you with your problem

It could be something wrong with LE. Can you check your domain (not subdomain, e.g. mail.domain.tld) with https://www.ssllabs.com/ssltest/ and see what you get.

First for your security you should eliminate this problems. Anything aside old android, IE6 and 8 on XP should not be there. Did you even get to rating C or D? Check this two topics https://www.virtualmin.com/node/41221 and https://www.virtualmin.com/node/41333 they should have more than enough info to sort this problem.

For your postfix it should work if you didnt manually edit some files and in the process set something wrong. Check if you have installed CA certificate because based on your main.cf it is missing. I dont know much about LE and to be honest i would not touch that with 2 mile long stick but it seems like postfix configuration problem or SSL didnt install properly. What OS is that? If previous suggestion didnt help can you remove old SSL and request/install new one?