[pfx] Re: MTA-STS and STARTTLS

2025-05-13 Thread Gregory Kohring via Postfix-users
stfix-users wrote: On Tue, May 13, 2025 at 02:43:52PM +0200, Gregory Kohring via Postfix-users wrote: posttls-finger -F /etc/ssl/certs/ca-certificates.crt -lsecure -Lsummary "[gmail-smtp-in.l.google.com]" posttls-finger: initializing the client-side TLS engine posttls-finger: Connec

[pfx] Re: MTA-STS and STARTTLS

2025-05-13 Thread Gregory Kohring via Postfix-users
On 5/13/25 15:04, Viktor Dukhovni via Postfix-users wrote: On Tue, May 13, 2025 at 02:43:52PM +0200, Gregory Kohring via Postfix-users wrote: posttls-finger -F /etc/ssl/certs/ca-certificates.crt -lsecure -Lsummary "[gmail-smtp-in.l.google.com]" posttls-finger: initializing the c

[pfx] Re: MTA-STS and STARTTLS

2025-05-13 Thread Gregory Kohring via Postfix-users
On 5/13/25 14:16, Viktor Dukhovni via Postfix-users wrote: On Tue, May 13, 2025 at 01:44:14PM +0200, Gregory Kohring via Postfix-users wrote: More likely misconfiguration, or perhaps some middlebox between you and Gmail. Test with: $ posttls-finger -c -F /etc/ssl/cert.pem -lsecure

[pfx] Re: MTA-STS and STARTTLS

2025-05-13 Thread Gregory Kohring via Postfix-users
On 5/13/25 13:10, Viktor Dukhovni via Postfix-users wrote: On Tue, May 13, 2025 at 12:23:40PM +0200, Gregory Kohring via Postfix-users wrote: Gmails MTA-STS policy says that all mails sent to google must be over TLS. No, it says no such thing, rather it provides the parameters necessary

[pfx] MTA-STS and STARTTLS

2025-05-13 Thread Gregory Kohring via Postfix-users
Hi, Gmails MTA-STS policy says that all mails sent to google must be over TLS. To test Google's claim using my postfix server, I set smtp_tls_security_level = may My certificates are from Let's Encrypt. I don't see anything in the log files related to TLS for the outgoing mail. Even with