On Fri, 7 Aug 2026 18:23:12 +0200 Jaroslaw Rafa via Postfix-users <[email protected]> wrote:
> Dnia 7.08.2026 o godz. 11:57:20 Jim Seymour via Postfix-users pisze: > > Thing is, self-signed certificates are only useful when you control > > both ends of the trust relationship. They don't provide any > > independent proof of identity because they're signed by the same > > entity claiming the identity. > > The certificates only come into play when you are the RECEIVING > side.If you are SENDING mail, no certificates are involved on your > side, at all. > > So trouble with SENDING mail to another server cannot be cause dby > certificates. I've never really looked into email encryption certificates, so I didn't know this. I don't run a public web server, so I have had no real reason for using a 'proper' certificate yet. As far as I'm aware, I have no problems receiving email. I regularly receive UK government emails, and also mail from Gmail and MS. Rather too much email from Google cloud users, which I've mostly tamed with a firewall. Is there, by the way, a method of filtering in Postfix based on the sending server name i.e. its PTR record? I could do this in exim4, but the filtering in Postfix seems based on the alleged sender name taken from the headers. I'd prefer to dispose of xxx.goggleusercontent.com in one go, rather than a long list of CIDR blocks. My firewall is a poor little Raspberry Pi, I'd like to keep the load down. The other certificate issue is that neither Android nor iOS will talk to my Postfix, although again there was never a problem with exim4. As far as I can tell, the Postfix certificate does not have a CA, the certificate was just generated in one go by OpenSSL. I have previously created a CA and then certificates for OpenVPN and RADIUS, both of which depend on the CA public key rather than the certificates directly. In those cases, the CA *must* be private. I've seen hints that CA public keys can be imported into Android and iOS, so this may be the answer here. I have in the past imported private CAs into web browsers and the clients of a Windows domain, but not to phones. I hate trying to do real computer things on phones. Thanks to all who have offered help, I hope not to need too much more. -- Joe _______________________________________________ Postfix-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
