On Fri, 7 Aug 2026 16:46:51 +0100 Joe via Postfix-users <[email protected]> wrote:
[snip] > > > Thanks to all for suggestions. > > My concern is that I was sending to Gmail recipients perfectly well > through the old server using exim4, then about four days later when > I got Postfix running on new hardware using an equally self-signed > certificate, it wasn't working. [snip] Thing is, self-signed certificates are only useful when you control both ends of the trust relationship. They don't provide any independent proof of identity because they're signed by the same entity claiming the identity. Unless every client (or service) that connects to your server has been explicitly configured to trust your private CA or self-signed certificate, it's reasonable to expect it to reject the certificate. Google—and increasingly many other providers—are placing greater emphasis on certificates that chain back to a publicly trusted CA. The days of assuming arbitrary self-signed certificates will be accepted are rapidly disappearing. And, IMO, there's really no longer much justification for using them—not with Let's Encrypt certs available. Regards, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://athena.LinxNet.com/contact/scform.php>. _______________________________________________ Postfix-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
