I am perplexed by an issue. Could someone help me figure out what is going wrong?
I recently brought up a new server running opensuse 12.1, which has postfix 2.8.8. I migrated the configuration from a server running postfix 2.7.2 (opensuse 11.4). It mostly works, except that permit_tls_clientcerts seems to be ignored. It continues to work using the old postfix server box. Here is how the daemon on port 587 is configured in master.cf: submission inet n - n - - smtpd -o smtpd_etrn_restrictions=reject -o smtpd_enforce_tls=yes -o smtpd_tls_req_ccert=yes -o smtpd_tls_key_file=/etc/ssl/private/smtp.killian.com.key -o smtpd_tls_cert_file=/etc/ssl/certs/smtp.killian.com.pem -o smtpd_helo_restrictions=reject_invalid_hostname,permit_tls_clientcerts,reject -o smtpd_sender_restrictions=reject_non_fqdn_sender,reject_unknown_sender_domain -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_tls_clientcerts,reject Some relevant lines from main.cf: relay_clientcerts = hash:/etc/postfix/relay_ccerts smtpd_tls_fingerprint_digest = sha1 Here is the relevant line from /etc/postfix/relay_ccerts: C4:89:7F:6D:A2:07:75:0D:52:29:50:92:F1:F6:F7:E0:3E:56:72:F0 guava.killian.com When I connect to it from a client on mynetworks, and with a client certificate that is in relay_ccerts, I get log rejected. Here is a snippet from /var/log/mail: Jun 15 08:06:06 maple postfix/smtpd[22400]: connect from guava.guavamaplevpn.killian.com[10.8.47.2] Jun 15 08:06:06 maple postfix/smtpd[22400]: setting up TLS connection from guava.guavamaplevpn.killian.com[10.8.47.2] Jun 15 08:06:07 maple postfix/smtpd[22400]: guava.guavamaplevpn.killian.com[10.8.47.2]: Trusted: subject_CN=guava.killian.com, issuer=CAcert Class 3 Root, fingerprint=C4:89:7F:6D:A2:07:75:0D:52:29:50:92:F1:F6:F7:E0:3E:56:72:F0 Jun 15 08:06:07 maple postfix/smtpd[22400]: Trusted TLS connection established from guava.guavamaplevpn.killian.com[10.8.47.2]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits) Jun 15 08:06:08 maple postfix/smtpd[22400]: NOQUEUE: reject: RCPT from guava.guavamaplevpn.killian.com[10.8.47.2]: 554 5.7.1 <guava.lah.killian.com>: Helo command rejected: Access denied; from=<REDACTED> to=<REDACTED> proto=ESMTP helo=<guava.lah.killian.com> Jun 15 08:06:10 maple postfix/smtpd[22400]: disconnect from guava.guavamaplevpn.killian.com[10.8.47.2] It seems to me that the submission port daemon should have processed smtpd_helo_restrictions=reject_invalid_hostname,permit_tls_clientcerts,reject and accepted the connection based on permit_tls_clientcerts. My question is why that didn't work?
