Re: TLS - Certificate not Trusted

2010-01-11 Thread LuKreme
On 11-Jan-2010, at 09:27, Dennis Putnam wrote: > I am quite familiar with the arguments but again it is not my choice. If you > want, I can give you the number of our corporate lawyers and you can try to > convince them. Perhaps you will have better luck than me. :-) I will be happy to email th

Re: TLS - Certificate not Trusted

2010-01-11 Thread Victor Duchovni
On Mon, Jan 11, 2010 at 11:36:42AM -0600, Noel Jones wrote: > According to the example in > http://www.postfix.org/TLS_README.html#client_tls_policy > the policy table should contain > > somedomain.tld encrypt > > To include subdomains of somedomain.tld also include > > .somedomain.tld

Re: TLS - Certificate not Trusted

2010-01-11 Thread Noel Jones
On 1/11/2010 11:16 AM, Dennis Putnam wrote: Hi Noel, Thanks. I thing you pointed me in the right direction. Am I correct that the per_site table is different under 2.5.5 than pre 2.3? I had trouble getting that to work on the old server so I didn't change it for the migration. What I have is: .

Re: TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
Hi Noel, Thanks. I thing you pointed me in the right direction. Am I correct that the per_site table is different under 2.5.5 than pre 2.3? I had trouble getting that to work on the old server so I didn't change it for the migration. What I have is: .somedomain.com MUST I think it now can be

Re: TLS - Certificate not Trusted

2010-01-11 Thread Noel Jones
On 1/11/2010 10:38 AM, Dennis Putnam wrote: Upon further investigation, apparently mail is not moving. There seems to be 2 domains associated with this site but I was only asked to enforce TLS on one of them. That is why it appeared to be working. Getting back to Chris' comments, I think setting

Re: TLS - Certificate not Trusted

2010-01-11 Thread /dev/rob0
On Mon, Jan 11, 2010 at 11:53:35AM -0500, Noah Sheppard wrote: [attribution to Chris is missing] > > >> On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: > > >>> I want to enforce TLS but I don't care what certificate the > > >>> receiver uses. Thanks. > > >> Apart from the fact that enforci

Re: TLS - Certificate not Trusted

2010-01-11 Thread Noah Sheppard
> >> On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: > >>> I want to enforce TLS but I don't care what certificate the receiver > >>> uses. Thanks. > >> Apart from the fact that enforcing TLS with SMTP is usually a bad idea, > >> [..] Why is TLS w/ SMTP a bad idea? -- Noah Sheppard Assis

Re: TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
Upon further investigation, apparently mail is not moving. There seems to be 2 domains associated with this site but I was only asked to enforce TLS on one of them. That is why it appeared to be working. Getting back to Chris' comments, I think setting the security level to 'encrypt' forces ever

Re: TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
Hi Chris, Thanks for the reply. Please see embedded comments. On Jan 11, 2010, at 11:11 AM, Christoph Anton Mitterer wrote: > On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: >> I want to enforce TLS but I don't care what certificate the receiver >> uses. Thanks. > Apart from the fact tha

Re: TLS - Certificate not Trusted

2010-01-11 Thread Christoph Anton Mitterer
On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: > I want to enforce TLS but I don't care what certificate the receiver > uses. Thanks. Apart from the fact that enforcing TLS with SMTP is usually a bad idea, setting the smtp_tls_security_level = encrypt should usually do what you mean, enfor

TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
I'm just getting started with version 2.5.5 and TLS is different that my previous version. I have everything thing working except some email will not go out because of the error "delivery temporarily suspended: Server certificate not trusted." What parameter do I have wrong that requires trusted