Viktor That's consistent with, and explains, what I've been seeing -- that, with smtpd_tls_req_ccert = yes , ccert restriction works with a commercial crt's fingerprint specified, but not with my self-signed cert.
I was digging in the self-signed cert itself, and having trouble figuring out what the problem is. Since I have a commercial crt handy, I simply dropped in it for the outbound smarthost relay's use/check. The smtpd_tls_ask_ccert = yes + check_ccert_access etc does work in the self-signed case. The need for this usage was not clear to me. Thanks.
