Hi I am getting lots of SSL_accept errors in the mail log files as a result of not being able to receive mail from certain servers. I think this is because of the sending servers not supporting ECDSA certificates which is what Lets Encrypt uses as far as I know and is what I am using on Postfix. I…

I don’t know if that’s actually the problem but Let’s Encrypt does provide RSA certificates as well, and most ACME clients will request RSA certificates by default unless you explicitly ask for ECDSA…

[image] applejack: Any ideas or a potential workaround ? Not without a lot more info. E.g., the relevant smtpd_tls_* directives of your main.cf and the hostname of the mailserver.

I just checked and the cert is actually RSA but one of the the signature algorithms is ECDSA. So whether that is the issue I have no idea.

Hostname is mail.snapto.co.uk smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_tls_auth_only = no smtp_tls_note_starttls_offer = yes smtpd_use_tls = yes smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s smtpd_tls_cert_…

A few things: [image] applejack: smtpd_tls_loglevel = 1 You might temporary try to raise this to 2, so you'll get TLS negotiation warning/errors. [image] applejack: smtpd_tls_cert_file = /etc/letsencrypt/live/snapto.co.uk/cert.pem This should be set to fullchain.pem, which would make…

[image] applejack: Any ideas or a potential workaround ? You may be able to use both (an RSA and an ECDSA cert). [although I don't think that would relieve this specific problem] A more likely cause is the preferred use of DHE ciphers with 1024 bit DH primes.

TLS v1 is now marked as insecure. The sending server I am having issues with is using TSv1.2 anyhow. The log level I already changed thanks.

What does this mean? [please explain more] [image] applejack: I tried not using the cipher list and made no difference

Re Cypher list I just commented it out.

SSL_accept error Postfix

Server

applejack February 7, 2019, 1:45pm 8

I tried not using the cipher list and made no difference

Topic		Replies	Views
Using let's encrypt certs with postfix Server	9	31706	September 20, 2016
Postfix doesn't work since last update of certificate (08/2019) Help	14	3317	October 3, 2019
Error after using certificate with SASL / SMTP server Server	9	4216	January 3, 2017
Sendmail TLS config errors - what's needed? Help	3	4212	October 17, 2016
Letsencrypt with postfix, can't send email Help	12	1607	November 16, 2022

SSL_accept error Postfix

Related topics