Hi Victor, yes, I looked at /etc/ssl/openssl.cnf and found nothing related to default or preloaded chain.
See the result of the debug from strace - only 3 cert related files are opened = the private key, full chain and DH param: openat(AT_FDCWD, "pid/inet.smtp", O_RDWR) = 9 openat(AT_FDCWD, "/etc/aliases.db", O_RDONLY) = 12 openat(AT_FDCWD, "/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = 13 openat(AT_FDCWD, "/etc/DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/aliases.db", O_RDONLY) = 13 openat(AT_FDCWD, "/etc/aliases.db", O_RDONLY) = 14 openat(AT_FDCWD, "/usr/lib/postfix/postfix-ldap.so", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/usr/lib/postfix/libldap_r-2.4.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libldap_r-2.4.so.2", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/usr/lib/postfix/liblber-2.4.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/liblber-2.4.so.2", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgnutls.so.30", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libp11-kit.so.0", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libidn2.so.0", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libunistring.so.2", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libtasn1.so.6", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnettle.so.6", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libhogweed.so.4", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgmp.so.10", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libffi.so.6", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 12 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libcrammd5.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libgssapiv2.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libntlm.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libscram.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libsasldb.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libgs2.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/etc/gss/mech.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libdigestmd5.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libanonymous.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/liblogin.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2/libplain.so", O_RDONLY|O_CLOEXEC) = 15 openat(AT_FDCWD, "/etc/ldap/ldap.conf", O_RDONLY) = 12 openat(AT_FDCWD, "ldaprc", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/postfix/tables/ldap-virtual_alias_maps", O_RDONLY) = 12 openat(AT_FDCWD, "/etc/postfix/tables/ldap-virtual_alias_maps-alternate", O_RDONLY) = 12 openat(AT_FDCWD, "/etc/postfix/tables/ldap-virtual_mailbox_maps", O_RDONLY) = 12 openat(AT_FDCWD, "/usr/lib/postfix/postfix-pcre.so", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/usr/lib/postfix/libpcre.so.3", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/etc/postfix/tables/pcre-check_helo_access", O_RDONLY) = 12 openat(AT_FDCWD, "/etc/postfix/sasl/smtpd.conf", O_RDONLY) = 12 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/sasl2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 12 openat(AT_FDCWD, "/dev/urandom", O_RDONLY) = 15 openat(AT_FDCWD, "/etc/postfix/tables/hash-tls_server_sni_maps.db", O_RDONLY) = 12 openat(AT_FDCWD, "/etc/postfix/tables/DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/postfix/tables/hash-tls_server_sni_maps.db", O_RDONLY) = 15 openat(AT_FDCWD, "/etc/postfix/tables/hash-tls_server_sni_maps.db", O_RDONLY) = 16 openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY) = 17 openat(AT_FDCWD, "/etc/letsencrypt/live/smtp.example.com/privkey.pem <http://smtp.example.com/privkey.pem>", O_RDONLY) = 17 openat(AT_FDCWD, "/etc/letsencrypt/live/smtp.example.com/fullchain.pem <http://smtp.example.com/fullchain.pem>", O_RDONLY) = 17 openat(AT_FDCWD, "/etc/ssl/local/dh_ffdhe4096.pem", O_RDONLY) = 17 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY) = 17 openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_systemd.so.2", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/librt.so.1", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/run/systemd/userdb/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 17 openat(AT_FDCWD, "/proc/sys/kernel/random/boot_id", O_RDONLY|O_NOCTTY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_sss.so.2", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/var/lib/sss/mc/initgroups", O_RDONLY|O_CLOEXEC) = 17 openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 22 openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 22 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/tls/haswell/x86_64/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/tls/haswell/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/tls/x86_64/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/tls/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/haswell/x86_64/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/haswell/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/x86_64/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 22 openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 22 openssl s_client -servername smtp.example.com <http://smtp.example.com/> -starttls smtp -connect smtp.example.com:25 <http://smtp.example.com:25/> Jun 9 22:17:55 example postfix/smtpd[246494]: warning: key at index 1 in SNI data for smtp.example.com <http://smtp.example.com/> does not match next certificate Jun 9 22:17:55 example postfix/smtpd[246494]: warning: TLS library problem: error:1426D121:SSL routines:ssl_set_cert_and_key:not replacing certificate:../ssl/ssl_rsa.c:1107: Jun 9 22:17:55 example postfix/smtpd[246494]: warning: error loading private keys and certificates from: SNI data for smtp.example.com <http://smtp.example.com/>: aborting TLS handshake Jun 9 22:17:55 example postfix/smtpd[246494]: SSL_accept error from ***[93.***.***.***]: -1 Jun 9 22:17:55 example postfix/smtpd[246494]: warning: TLS library problem: error:1422E0EA:SSL routines:final_server_name:callback failed:../ssl/statem/extensions.c:1007: Jun 9 22:17:55 example postfix/smtpd[246494]: lost connection after STARTTLS from ***[93.***.***.***] Jun 9 22:17:55 example postfix/smtpd[246494]: disconnect from ***[93.184.***.***] ehlo=1 starttls=0/1 commands=1/2 server log: Jun 9 22:17:55 example postfix/smtpd[246494]: warning: key at index 1 in SNI data for smtp.example.com <http://smtp.example.com/> does not match next certificate Jun 9 22:17:55 example postfix/smtpd[246494]: warning: TLS library problem: error:1426D121:SSL routines:ssl_set_cert_and_key:not replacing certificate:../ssl/ssl_rsa.c:1107: Jun 9 22:17:55 example postfix/smtpd[246494]: warning: error loading private keys and certificates from: SNI data for smtp.example.com <http://smtp.example.com/>: aborting TLS handshake Jun 9 22:17:55 example postfix/smtpd[246494]: SSL_accept error from ***[93.***.***.***]: -1 Jun 9 22:17:55 example postfix/smtpd[246494]: warning: TLS library problem: error:1422E0EA:SSL routines:final_server_name:callback failed:../ssl/statem/extensions.c:1007: Any further ideas? Thanks, JM
