View source for TLS
{{hits}}
==TLS on submission==
outoing mail on tcp port 587
{{ToC from="h2" to="h3"}}
===Create a new self-signed certificate===
%%(bash)
openssl req -new -x509 -nodes -out smtp.example.com.crt -keyout smtp.example.com.key -days 1825 -newkey rsa:4096
%%
===Configure submission daemon===
**vim /etc/postfix/master.cf**
%%
submission inet n - n - - smtpd
-o smtpd_enforce_tls=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o smtpd_starttls_timeout=30s
-o smtpd_tls_cert_file=/certs/smtp.example.com.crt
-o smtpd_tls_key_file=/certs/smtp.example.com.key
%%
%%
postfix stop
postfix start
%%
===simply testing===
%%
[~]# telnet smtp.example.com 587
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 smtp.example.com ESMTP Postfix
ehlo smtp.example.com
250-smtp.example.com
250-PIPELINING
250-SIZE 35651584
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
^]
telnet> clo
Connection closed.
%%
===firewall===
%%
[~]# iptables -nL | grep 587
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:587
%%