My domain is: redstonedesigner.com
I’m attempting to configure Postfix to use the SSL certificate generated by Certbot in order to send emails that come up as TLS-secured in Gmail (currently they come up as unsecured)
The operating system my web server runs on is (include version): Debian 10 (Buster) (Linux 4.19.0-8-amd64 on x86_64)
My hosting provider, if applicable, is: Contabo
I can login to a root shell on my machine (yes or no, or I don’t know): Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): Sometimes. Using Webmin 1.941, but doesn’t have much effect.
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): 0.31.0
Osiris
May 21, 2020, 12:04pm
2
I’m trying to understand your issue here, but I’m having trouble:
You’ve secured your postfix with a Let’s Encrypt (LE) TLS certificate. Was this succesful? You don’t say in your post.
Also, it’s about SENDING emails to Gmail. As far as I know, the LE certificate used for RECEIVING e-mails through TLS in Postfix isn’t related to the secure SENDING of emails to Gmail.
The Postfix configuration file (main.cf) uses the smtp_tls_ prefix for its TLS settings related to its SMTP client for sending emails. It uses the smtpd_tls_ prefix (notice the subtle difference!) for its TLS settings related to its SMTP server for receiving emails. What are your smtp_tls_ and smtpd_tls_ settings?
Securing was successful.
smtpd_tls_cert_file = /etc/letsencrypt/live/redstonedesigner.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/redstonedesigner.com/privkey.pem
smtpd_use_tls=yes
smtpd_tls_loglevel=0
smtpd_tls_received_header=yes
smtpd_tls_security_level = encrypt
smtpd_tls_note_starttls_offer=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_cert_file=/etc/letsencrypt/live/redstonedesigner.com/fullchain.pem
smtp_tls_key_file=/etc/letsencrypt/live/redstonedesigner.com/key.pem
smtp_use_tls = yes
smtp_tls_loglevel=0
smtp_tls_received_header=yes
smtp_tls_security_level=may
smtp_tls_note_starttls_offer=yes
redstonedesigner:
Securing was successful.
I agree, the Let's Encrypt cert looks fine on your SMTP server.
This is for client TLS certification, which is normally not used in regular SMTP servers. Notice the difference between smtp and smtpd in the options. See for more information: Postfix Configuration Parameters
This option (without the "d" in "smtp_") doesn't exist for the SMTP client, only for the SMTP server (with the "d" in "smtpd_").
Perhaps the client certificate thing matters, but as far as I know, it shouldn't. Could you please post the *headers* of an email sent from your Postfix to Gmail which is labled as insecure?
Delivered-To: redstonedesigner1@gmail.com d=google.com ; s=arc-20160816;d=google.com ; s=arc-20160816;mx.google.com ;header.i=@redstonedesigner.com header.s=dkim header.b=5X6lL8ZR;google.com : domain of noreply@redstonedesigner.com designates 144.91.64.225 as permitted sender) smtp.mailfrom=noreply@redstonedesigner.com ;header.from=redstonedesigner.com noreply@redstonedesigner.com redstonedesigner.com (redstonedesigner.com . [144.91.64.225])mx.google.com with ESMTP id g7si1587497wmg.44.2020.05.21.07.33.25redstonedesigner1@gmail.com ;google.com : domain of noreply@redstonedesigner.com designates 144.91.64.225 as permitted sender) client-ip=144.91.64.225;mx.google.com ;header.i=@redstonedesigner.com header.s=dkim header.b=5X6lL8ZR;google.com : domain of noreply@redstonedesigner.com designates 144.91.64.225 as permitted sender) smtp.mailfrom=noreply@redstonedesigner.com ;header.from=redstonedesigner.com redstonedesigner.com (Postfix, from userid 1002)d=redstonedesigner.com ;noreply@redstonedesigner.com redstonedesigner1@gmail.com 1590071605.13868@redstonedesigner.com
Hm, too bad, that doesn't tell me much. Actually, it does.
Compare these headers:
Yours:
Mine:
Received: from lb1-smtp-cloud9.xs4all.net (lb1-smtp-cloud9.xs4all.net. [194.109.24.22])
by mx.google.com with ESMTPS id o12si3380366edq.34.2020.05.21.07.56.55
for <...@gmail.com>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Thu, 21 May 2020 07:56:56 -0700 (PDT)
GMail lists the TLS only if it's present. If it's lacking, the mentioning of the TLS is lacking. As such, it seems your Postfix doesn't indeed send its mail through a secure channel.
Have you removed the client authentication part of your configuration already and tried again?
What do you mean “remove client authentication”?
I have done that, and it still shows as insecure.
Osiris
May 21, 2020, 3:11pm
10
What does your Postfix log say when you send an email to GMail?
May 21 16:16:01 redstonedesigner postfix/sendmail[17638]: warning: /etc/postfix/main.cf, line 23: overriding earlier entry: smtpd_tls_session_cache_database=btree:{data_directory}/smtpd_scache
May 21 16:16:01 redstonedesigner postfix/postdrop[17639]: warning: /etc/postfix/main.cf, line 23: overriding earlier entry: smtpd_tls_session_cache_database=btree: {data_directory}/smtpd_scache20200521151601.648AE20401F7@redstonedesigner.com root@redstonedesigner.com , size=711, nrcpt=1 (queue active)root@redstonedesigner.com , orig_to=, relay=local, delay=0.06, delays=0.06/0/0/0, dsn=2.0.0, status=sent (delivered to maildir)
Osiris
May 21, 2020, 3:37pm
12
Could you please set smtp_tls_loglevel to 1, reload Postfix, try again and post the log of that attempt again?
May 21 17:28:56 redstonedesigner postfix/trivial-rewrite[2778]: warning: /etc/postfix/main.cf, line 23: overriding earlier entry: smtpd_tls_session_cache_database=btree:{data_directory}/smtpd_scache
May 21 17:28:56 redstonedesigner postfix/cleanup[2777]: F060520401F2: message-id=<1590078536.2773@redstonedesigner.com>
May 21 17:28:57 redstonedesigner postfix/qmgr[1982]: F060520401F2: from=<noreply@redstonedesigner.com>, size=671, nrcpt=1 (queue active)
May 21 17:28:57 redstonedesigner postfix/smtp[2779]: warning: /etc/postfix/main.cf, line 23: overriding earlier entry: smtpd_tls_session_cache_database=btree: {data_directory}/smtpd_scacheredstonedesigner1@gmail.com , relay=gmail-smtp-in.l.google.com [173.194.76.27]:25, delay=0.37, delays=0.08/0.02/0.06/0.22, dsn=2.0.0, status=sent (250 2.0.0 OK 1590078537 h15si5374954wrx.350 - gsmtp){data_directory}/smtpd_scache
May 21 17:29:01 redstonedesigner postfix/postdrop[2892]: warning: /etc/postfix/main.cf, line 23: overriding earlier entry: smtpd_tls_session_cache_database=btree: {data_directory}/smtpd_scache20200521162901.87C3520401F2@redstonedesigner.com root@redstonedesigner.com , size=711, nrcpt=1 (queue active)root@redstonedesigner.com , orig_to=, relay=local, delay=0.07, delays=0.05/0.01/0/0, dsn=2.0.0, status=sent (delivered to maildir)
Osiris
May 21, 2020, 4:33pm
14
I’m not seeing any TLS related log entries at all
What if you temporarily change smtp_tls_security_level to encrypt and try again? It should either use TLS or fail entirely.
Webmin (my control panel) now won’t send my message and shows the following:
Osiris
May 21, 2020, 4:51pm
16
Is openssl installed on the server at all?
Also, please follow this guide I’ve managed to find: https://www.digitalreborn.com/fix-postfix-tls-is-required-but-our-tls-engine-is-unavailable-error/ (actually, it was the first result when Google-ing "tls engine is unavailable" debian.)
OpenSSL is installed.
That guide does not do anything, the emails are still in the mail queue.
Osiris
May 21, 2020, 5:29pm
18
What’s the entire output of postconf?
https://pastebin.com/raw/cd6hF6va
The output was too long for me to post here.
Osiris
May 21, 2020, 5:35pm
20
I see you still have smtp_tls_cert_file and smtp_tls_key_file set? Why?
