Re: How to force remote deliver agent to send messages via SSL only

2021-08-18 Thread Ralph Seichter
* Ken N.: > does ubuntu linux have the keystone chain management? thanks. "Keychain" is Apple's name for an application that deals with system-wide and user-specific passwords, certificates, and other sensitive information. Ubuntu uses a different mechanism, as do the other Linux distributions.

Re: How to force remote deliver agent to send messages via SSL only

2021-08-15 Thread raf
On Sun, Aug 15, 2021 at 09:27:28PM +0200, Matus UHLAR - fantomas wrote: > > On Sat, Aug 14, 2021 at 02:43:29PM +0200, Matus UHLAR - fantomas > > wrote: > > > > > - dedicated port for smtp/ssl was deprecated (in fact never standrdized) > > On 15.08.21 09:04, raf wrote: > > I think that used

Re: How to force remote deliver agent to send messages via SSL only

2021-08-15 Thread Ken N
does ubuntu linux have the keystone chain management? thanks. On 2021/8/16 2:03 上午, Ralph Seichter wrote: One can import self-signed certs and/or certificate authority data directly into TB's own keystore, but importing into the OS keystore (e.g. the system keychain for macOS) is usually more

Re: How to force remote deliver agent to send messages via SSL only

2021-08-15 Thread Matus UHLAR - fantomas
On 15.08.21 08:34, Lauren R wrote: Thank you @raf. We were using the certs from a commercial CA, not the free one. this does not matter. We use let's encrypt certificates on multiple servers. So far, certificates for server-server communication are not required to be officially signed which

Re: How to force remote deliver agent to send messages via SSL only

2021-08-15 Thread Matus UHLAR - fantomas
On Sat, Aug 14, 2021 at 02:43:29PM +0200, Matus UHLAR - fantomas wrote: - dedicated port for smtp/ssl was deprecated (in fact never standrdized) On 15.08.21 09:04, raf wrote: I think that used to be true, but they had a rethink. This proposed standard (Jan 2018) indicates so: 3.3.

Re: How to force remote deliver agent to send messages via SSL only

2021-08-15 Thread Ralph Seichter
* raf: > Maybe Thunderbird only complains about self-signed certificates for > getting mail (IMAPS/POPS), rather than for sending mail (SMTP/ > STARTTLS). I don't know. Thunderbird complains about all certificates that cannot be verified using either the OS keystore or TB's own keystore. That

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread Benny Pedersen
On 2021-08-15 01:06, Lauren R wrote: so for server to server use, we should deploy starttls on port 25? yes port 465, 587 is need password

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread Lauren R
Thank you @raf. We were using the certs from a commercial CA, not the free one. On 2021/8/15 8:05 上午, raf wrote: On Sun, Aug 15, 2021 at 09:37:17AM +1000, raf wrote: I recommend using a CA-approved certificate like LetsEncrypt just because Postfix will use the same certificate for

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread raf
On Sun, Aug 15, 2021 at 09:37:17AM +1000, raf wrote: > I recommend using a CA-approved certificate like > LetsEncrypt just because Postfix will use the same > certificate for submissions on port 587, and mail > clients (like Thunderbird) might complain if a > self-signed certificate is used in

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread raf
On Sun, Aug 15, 2021 at 07:06:06AM +0800, Lauren R wrote: > On 2021/8/15 7:04 上午, raf wrote: > > So "smtps" is dead. Long live "submissions". > > > > But it isn't for server-to-server use. > > so for server to server use, we should deploy starttls on port 25? > > thanks > Lauren Yes. Once you

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread Lauren R
so for server to server use, we should deploy starttls on port 25? thanks Lauren On 2021/8/15 7:04 上午, raf wrote: So "smtps" is dead. Long live "submissions". But it isn't for server-to-server use.

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread raf
On Sat, Aug 14, 2021 at 02:43:29PM +0200, Matus UHLAR - fantomas wrote: > - dedicated port for smtp/ssl was deprecated (in fact never standrdized) I think that used to be true, but they had a rethink. This proposed standard (Jan 2018) indicates so: 3.3. Implicit TLS for SMTP Submission

Re: How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread Matus UHLAR - fantomas
On 14.08.21 20:39, Lauren R wrote: I have installed postfix on the ubuntu system, SSL port is enabled. How can I force the other mail systems such as gmail to send messages to my postfix via only SSL port? you can't: - dedicated port for smtp/ssl was deprecated (in fact never standrdized) -

How to force remote deliver agent to send messages via SSL only

2021-08-14 Thread Lauren R
Hi, I have installed postfix on the ubuntu system, SSL port is enabled. How can I force the other mail systems such as gmail to send messages to my postfix via only SSL port? Thanks.