Re: tlc client cert authentication -- fingerprint matches, but client's not trusted.

[pgndev]

Noel

> Have you tried with the default setting of smtpd_tls_ccert_verifydepth?


No.

At

    http://www.postfix.org/postconf.5.html#smtpd_tls_ccert_verifydepth
        smtpd_tls_ccert_verifydepth (default: 9)

Changed

-    -o smtpd_tls_ccert_verifydepth=2
+    -o smtpd_tls_ccert_verifydepth=9

On submit, now

    May 18 20:23:57 border postfix/smarthost/smtpd[10391]: Trusted TLS
connection established ...

Works.  Possibly at lower depths, too; =5-9 looks safe.

I'd incorrectly carried over the =2 from an all self-signed/local-certs setup.

Thanks.

PGNd