smtp inet n - n - - smtpd
-o smtpd_tls_cert_file=/etc/letsencrypt/live/(name).pem
-o smtpd_tls_key_file=/etc/letsencrypt/live/(name).pem
-o smtp_tls_cert_file=/etc/letsencrypt/live/(name).pem
-o smtp_tls_key_file=/etc/letsencrypt/live/(name).pem
submission inet n - n - - smtpd
-o smtpd_tls_cert_file=/etc/letsencrypt/live/(name).pem
-o smtpd_tls_key_file=/etc/letsencrypt/live/(name).pem
-o smtp_tls_cert_file=/etc/letsencrypt/live/(name).pem
-o smtp_tls_key_file=/etc/letsencrypt/live/(name).pem
In Postfix 3.4 ``smtp(d)_tls_chain_files'' got introduced.
It combines tls_key and tls_cert and their specific counterparts for non RSA
certs.
You can use it as follows:
smtp_tls_chain_files = /path/to/cert.pem, /path/to/anothercert.pem
(Can also be separated by just space)
And cert beeing of the form:
key1, cert1, [chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN]
This is especially useful, if you're using RSA and e.g. Ed25519
Do I need smtp_tls_cert/key in the smtp section or is it superfluous/stupid?
Please note, that smtp(d)_tls_cert_file may also contain the RSA private key thus
specifying it again is redundant.
Please note:
smtpd_tls* is for receiving connections.
smtp_tls* is for outgoing connections.
You're specifying the same certificate thus makings it redundant.
You may shorten it to just two lines in your main.cf:
smtp_tls_chain_files = /etc/letsencrypt/live/(name).pem
smtpd_tls_chain_files = /etc/letsencrypt/live/(name).pem
Greetings
Anton
