Activating TLS in Postfix

Activate TLS in Postfix to ensure that the communication between your intercepted application and the Postfix SMTP-Relay is secured by TLS.

Before you begin

The task requires the following:
  • You have the TLS certificate including the certificate chain as a PEM encoded file.
  • You have your private key as a PEM encoded file.

About this task

It is possible to have all relevant parts of the certificate inside one single file with the certificate chain at the top and the private key at the bottom. The data must not be password protected. To prevent misuse of the data, you can protect the data via file system protection. To extract the certificate chain/private key PEM encoded from a PKCS#12 or JKS keystore file, you may use tools like portecle (http://portecle.sourceforge.net/).
Important: Please note the following:
  • It is described how to activate STARTTLS in Postfix.
  • The instructions are valid for Postfix version 3.3. The setup for a different version may differ.

Procedure

  1. Upload the file containing the certificate and the private key (for example certs.pem) to your Postfix server.
  2. Move the certs.pem file to a suitable folder, for example /etc/postfix/ssl/.
  3. Protect the certs.pem file via file system protection (as it is not password protected).
  4. Edit the main Postfix configuration file /etc/postfix/main.cf: 
    nano /etc/postfix/main.cf
  5. Configure the path to your certificate chain file by adding or modifying the following entry: 
    smtpd_tls_cert_file = /etc/postfix/ssl/certs.pem
  6. Configure the path to your private key file by adding or modifying the following entry: 
    smtpd_tls_key_file = /etc/postfix/ssl/certs.pem
    Note: In the example above, both the certificates and the private key are stored in the same file.
  7. Enable TLS by adding the following entry: 
    smtpd_tls_security_level = may
  8. Save and exit the main.cf file.
  9. Restart Postfix, for example: 
    sudo systemctl restart postfix

Results

You have successfully activated TLS (STARTTLS) in Postfix. The communication between your intercepted application and the Postfix SMTP-Relay is now secured by TLS.