On Mon, May 18, 2015 at 08:08:56PM -0700, pgndev wrote:
> cat /etc/postfix/smarthost_clientcerts
> 17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
> commercial.crt
>
> On mail submit from the client via the smarthost, log on the smarthost reports
This is an authorization record.
> May 18 19:14:56 border postfix/smarthost/smtpd[9615]:
> internal.XXX.com[172.30.7.113]: subject_CN=*.XXX.com, issuer=COMODO
> RSA Domain Validation Secure Server CA,
> fingerprint=42:1C:FD:99:2F:81:B2:55:07:42:D5:1F:EF:49:6D:43:96:1E:BC:D9,
> pkey_fingerprint=17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
Excellent, it will match.
> May 18 19:14:56 border postfix/smarthost/smtpd[9615]: Untrusted
> TLS connection established from internal.XXX.com[172.30.7.113]:
> TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
This is expected, the client certificate issuer CA is not "trusted",
but that's a CA PKI authentication issue, that has nothing to do
with how Postfix authorizes clients.
> May 18 19:14:56 border postfix/smarthost/smtpd[9615]: NOQUEUE:
> abort: TLS from internal.XXX.com[172.30.7.113]: Client certificate not
> trusted
Don't use restrictions that require "trusted" client certificates.
Postfix does not impost such restrictions by default.
--
Viktor.
