Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove default config for smtpd_tls_cert_file and smtpd_tls_key_file to avoid warning message in logs #46

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

guipe
Copy link

@guipe guipe commented Jul 29, 2022

When TLS is not used, if we let default configuration:

smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

These warning messages appears in /var/log/maillog:

Jul 29 14:24:01 postfix/smtpd[24123]: warning: cannot get RSA certificate from file "/etc/ssl/certs/ssl-cert-snakeoil.pem": disabling TLS support
Jul 29 14:24:01 postfix/smtpd[24123]: warning: TLS library problem: error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:288:fopen('/etc/ssl/certs/ssl-cert-snakeoil.pem','r'):
Jul 29 14:24:01 postfix/smtpd[24123]: warning: TLS library problem: error:20074002:BIO routines:file_ctrl:system lib:../crypto/bio/bss_file.c:290:
Jul 29 14:24:01 postfix/smtpd[24123]: warning: TLS library problem: error:140DC002:SSL routines:use_certificate_chain_file:system lib:../ssl/ssl_rsa.c:596:

As these files are removed from Dockerfile command, we must remove these ones from main.cf default configuration.

@mastamark
Copy link

mastamark commented Apr 25, 2023

As a note I too was trying to run with USE_TLS=no and I was additionally having some issues with clients connecting and running into the default values in main.cf for these 2:
smtpd_tls_security_level=may
smtp_tls_security_level=may

Setting them both to none solved the problem for me as found from here.

The provided params to use to tweak these settings (TLS_SECURITY_LEVEL && CLIENT_TLS_SECURITY_LEVEL) were not being consumed or set because of the overriding USE_TLS=no.

I am able to get around it by a few different ways - another set of seds in the dockerfile or an else condition on the USE_TLS if loop for when its no to update, or some other option I didn't think of but I figured I'd call this out for anyone else who was trying to fully disable TLS and running into problems still even after using the above fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants