Hi folks,
since the upgrade to OpenBSD 6.9 at the weekend opensmtpd complains
smtp cert-check result="no certificate presented"
for incoming EMails. opensmtpd.conf and the certificate chain
hasn't changed. There is only a single MX defined in DNS (for
both "example.com" and "example.de"), matching the certificate.
The FAQs for the openbsd upgrade state for opensmtpd
Configurations that use only a single certificate do not need updating.
Did I miss something here? Every helpful comment is highly appreciated.
Harri
# This is the smtpd server system-wide configuration file.
# See smtpd.conf(5) for more information.
# https://man.openbsd.org/OpenBSD-6.9/smtpd.conf.5
xname = "mail.example.de"
pki $xname cert "/etc/ssl/public/mail.example.de.chain.pem"
pki $xname key "/etc/ssl/private/smtpd.key.pem"
pki $xname dhe auto
#
# ca can be used to introduce another root CA authority. Intermediate
# certs should be appended to the client certificate, instead.
#
# ca $xname cert "/etc/ssl/public/DigiCertCA.crt"
listen on lo0 tls pki $xname
listen on internal tls pki $xname
listen on external tls pki $xname
smtp max-message-size 128M
table aliases db:/etc/mail/aliases.db
#
# permitted hosts: srvvm01, gate4a/b
table trusted_mta {192.168.96.11 192.168.96.22 192.168.98.246 192.168.98.248 }
table at_example {"@example.de", "@example.com"}
table example {"example.de", "example.com"}
table spf_protection_outlook_com
file:/etc/mail/spf_protection_outlook_com
table external_mta file:/etc/mail/external_mta
action "local" mbox alias <aliases>
action "relay_example" relay host smtp://mailhost.ac.example.de helo
"mail.example.de"
action "relay_external" relay src { 10.145.142.10
2001:db8:13b0:ffff::60 } helo "mail.example.de"
#
# first match wins, default is to reject.
#
# "from local" and "for local" are the defaults, but it is good practice to not
# omit these statements.
#
match from local for local
action "local"
match from local for domain <example>
action "relay_example"
match from local for any
action "relay_external"
match from src <trusted_mta> for domain <example>
action "relay_example"
match from src <spf_protection_outlook_com> for domain <example>
action "relay_example"
match from src <external_mta> for domain <example>
action "relay_example"
match from src <trusted_mta> for any
action "relay_external"
match from any mail-from <at_example> for any
reject
match from any for domain <example>
action "relay_example"
# the rest is rejected by default
match from any for any reject
