On Tue, May 19, 2015 at 08:53:59AM +0000, Viktor Dukhovni wrote:
> > May 18 19:14:56 border postfix/smarthost/smtpd[9615]: NOQUEUE:
> > abort: TLS from internal.XXX.com[172.30.7.113]: Client certificate not
> > trusted
>
> Don't use restrictions that require "trusted" client certificates.
> Postfix does not impost such restrictions by default.
In particular don't use:
smtpd_tls_req_ccert = yes
that form requires a certificate issued by a trusted CA. Perhaps
that's not obvious, and not even the best interface, but it is
backwards compatible. So that's what we have.
Instead use:
smtpd_tls_ask_ccert = yes
and use "check_ccert_access" or similar, to deny access to clients
that don't present a suitable certificate.
There is not yet in Postfix a way to require a client certificate,
without requiring that it's issuing chain be trusted.
--
Viktor.
