On Tue, May 19, 2015 at 04:25:52PM -0700, pgndev wrote:
> That's consistent with, and explains, what I've been seeing -- that,
> with smtpd_tls_req_ccert = yes
> ccert restriction works with a commercial crt's fingerprint
> specified, but not with my self-signed cert.
>
> I was digging in the self-signed cert itself, and having trouble
> figuring out what the problem is. Since I have a commercial crt
> handy, I simply dropped in it for the outbound smarthost relay's
> use/check.
>
> The smtpd_tls_ask_ccert = yes + check_ccert_access etc does work in
> the self-signed case. The need for this usage was not clear to me.
A good habit with Postfix is to read the documentation of each
parameter that you explicitly set in your main.cf file.
http://www.postfix.org/postconf.5.html#smtpd_tls_req_ccert
smtpd_tls_req_ccert (default: no)
With mandatory TLS encryption, require a trusted remote
SMTP client certificate in order to allow TLS connections
to proceed. This option implies "smtpd_tls_ask_ccert = yes".
The key word there is "trusted". Perhaps the text could be a bit
less concise, and add a comment to the effect that 'trusted' means
issued by a trusted CA (see smtpd_tls_CAfile, smtpd_tls_CApath).
--
Viktor.
