Using smtpd_tls_req_ccert=yes on port 587.
########################################
submission inet n - - - - smtpd
-o smtpd_tls_cert_file=/blah/server.crt
-o smtpd_tls_key_file=/blah/server.key
-o smtpd_tls_CAfile=/blah/ca.crt
-o smtpd_tls_security_level=encrypt
-o smtpd_tls_loglevel=2
-o smtpd_tls_req_ccert=yes
-o smtpd_tls_session_cache_database=btree:${data_directory}/smtpd_scache
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_sasl_auth_enable=yes
-o
smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
########################################
The client is an iPhone 3G, latest OS. TLS on the iPhone works pretty
well with Dovecot and imaps ("ssl_require_client_cert: yes" in
dovecot.conf). Dovecot uses exactly the same certificates (ca.crt,
server.crt, server.key) like Postfix. All is well with imaps.
But when trying to send email from the iPhone on port 587, I get this:
#############################################
Aug 21 00:06:09 server postfix/smtpd[15709]: connect from some.host[X.Y.Z.K]
Aug 21 00:06:09 server postfix/smtpd[15709]: setting up TLS connection
from some.host[X.Y.Z.K]
Aug 21 00:06:09 server postfix/smtpd[15709]: some.host[X.Y.Z.K]: TLS
cipher list "ALL:!EXPORT:!LOW:+RC4:@STRENGTH:!aNULL"
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:before/accept
initialization
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 read
client hello B
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 write
server hello A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 write
certificate A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 write
server done A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 flush data
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 read
client key exchange A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 read
finished A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 write
change cipher spec A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 write
finished A
Aug 21 00:06:09 server postfix/smtpd[15709]: SSL_accept:SSLv3 flush data
Aug 21 00:06:09 server postfix/smtpd[15709]: Anonymous TLS connection
established from some.host[X.Y.Z.K]: TLSv1 with cipher AES128-SHA
(128/128 bits)
Aug 21 00:06:09 server postfix/smtpd[15709]: NOQUEUE: abort: TLS from
some.host[X.Y.Z.K]: No client certificate presented
Aug 21 00:06:09 server postfix/smtpd[15709]: disconnect from
some.host[X.Y.Z.K]
Aug 21 00:06:09 server postfix/smtpd[15709]: connect from some.host[X.Y.Z.K]
Aug 21 00:06:09 server postfix/smtpd[15709]: lost connection after HELO
from some.host[X.Y.Z.K]
Aug 21 00:06:09 server postfix/smtpd[15709]: disconnect from
some.host[X.Y.Z.K]
#########################################
If I change it to smtpd_tls_req_ccert=no then everything is fine, an
anonymous TLS connection is established and email is delivered:
###########################################
Aug 21 00:13:37 server postfix/smtpd[16301]: connect from some.host[X.Y.Z.K]
Aug 21 00:13:37 server postfix/smtpd[16301]: setting up TLS connection
from some.host[X.Y.Z.K]
Aug 21 00:13:37 server postfix/smtpd[16301]: some.host[X.Y.Z.K]: TLS
cipher list "ALL:!EXPORT:!LOW:+RC4:@STRENGTH"
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:before/accept
initialization
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 read
client hello B
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 write
server hello A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 write
certificate A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 write
server done A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 flush data
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 read
client key exchange A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 read
finished A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 write
change cipher spec A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 write
finished A
Aug 21 00:13:37 server postfix/smtpd[16301]: SSL_accept:SSLv3 flush data
Aug 21 00:13:37 server postfix/smtpd[16301]: Anonymous TLS connection
established from some.host[X.Y.Z.K]: TLSv1 with cipher AES128-SHA
(128/128 bits)
#####################################
Is there any magic incantation that needs to be performed to convince
the iPhone to present the certificate to Postfix? The puzzling part is
that it seems to work fine with Dovecot and imaps.
I installed the client cert on the iPhone by uploading it to a local web
server and browsing it on the iPhone - Safari detects the cert and
installs it automatically.
--
Florin Andrei
http://florin.myip.org/
