Hi, > Um, no. By default Postfix is not going to use TLS at all. When > activated, by default, no certificate verification is done at all. > Consult your distributor's package documentation if they have set > different defaults.
If I set smtp_tls_CApath to /etc/ssl/certs and then again to something else, it looks like the CAs from /etc/ssl/certs are being all the time loaded: Here is what I did: 1- clean installation of Postfix (2.5.5) on Debian Lenny 2- TLS policy mapping for destination tls.com "verify match=test-tls.com" 3- copy the CA of the test-tls.com to /etc/ssl/certs and run c_rehash 3- leave smtp_tls_CApath empty If I send an email now, it gets deffered (Server certificate not trusted). Until now it makes perfect sense. Now I set: ~ $ postconf -e smtp_tls_CApath=/etc/ssl/certs/ and reload postfix If I send an email, it is correctly sent via TLS. Again, it makes sense. Thing is that now, I set smtp_tls_CApath to something else (empty directory) and the CA is still trusted : ~ $ mkdir -p /foo/bar ~ $ postconf -e smtp_tls_CApath=/foo/bar/ ~ $ postfix reload Postfix log: > tls.com[10.2.87.10]:25: Matched subject_CN=test-tls.com, issuer_CN=Admin Test > TLS .. so how can the certificate be trusted if I point the smtp_tls_CApath to an empty dir ? Still with smtp_tls_CApath pointing to /foo/bar, I delete my CA from /etc/ssl/certs/ and rehash, the email gets again deferred: > relay=tls.com[10.2.87.10]:25, delay=0.11, delays=0.01/0.03/0.07/0, dsn=4.7.5, > status=deferred (Server certificate not trusted) .. so there must be somewhere a reference to /etc/ssl/certs Did I miss something ? Thanks for your help, Jan
