I've a dovecot instance setup with submission proxy,
protocols = imap lmtp submission sieve
hostname = internal.mx.example.com
submission_relay_host = internal.mx.example.com
submission_relay_port = 465
submission_relay_trusted = yes
submission_relay_ssl = smtps
submission_relay_ssl_verify = yes
service submission-login {
inet_listener submission {
address = 10.2.2.10, 127.0.0.1
port = 50465
ssl = yes
}
}
protocol submission {
ssl_cert = < /sec/vmail/mx.example.com.server.EC.crt.pem
ssl_key = < /sec/vmail/mx.example.com.server.EC.key.pem
ssl_verify_client_cert = no
}
It submits to a postfix instance, atm on the same host,
[internal.mx.example.com]:465 inet n - n - - smtpd
-o smtpd_tls_req_ccert=no
with that setup, all works as expected.
If I turn ON required client cert verification @ postfix,
- -o smtpd_tls_req_ccert=no
+ -o smtpd_tls_req_ccert=yes
with that add'l req't, postfix log reports "no client certificate presented"
Jul 18 14:52:38 mx postfix/submit-from-dovecot/smtpd[37133]: connect
from internal.mx.example.com[10.2.2.10]
Jul 18 14:52:39 mx postfix/submit-from-dovecot/smtpd[37133]: Anonymous
TLS connection established from internal.mx.example.com[10.2.2.10]: TLSv1.3
with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519
server-signature ECDSA (P-384) server-digest SHA384
Jul 18 14:52:39 mx postfix/submit-from-dovecot/smtpd[37133]: NOQUEUE:
abort: TLS from internal.mx.example.com[10.2.2.10]: No client certificate
presented
Jul 18 14:53:09 mx postfix/submit-from-dovecot/smtpd[37133]: disconnect
from internal.mx.example.com[10.2.2.10] commands=0/0
Clearly, I'm missing config.
What in my dovecot submission config^^ do I need to change/add to get it to
'present' a client cert to the postfix relay for client cert verification?
