[Solved] Postfix: Cannot start TLS: handshake failure

smguenther

Hello,
my current problem is, that both emails collected by fetchmail and mail send from the command line, are not delivered to Grommunio:

Aug 10 18:56:09 grommunio postfix/qmgr[1699]: D218C1922: from=<grommunio@xxxx.de>, size=458, nrcpt=2 (queue active)
Aug 10 18:56:09 grommunio postfix/error[15078]: D218C1922: to=<archive@grommunio.xxx.de>, relay=none, delay=0.61, delays=0.41/0.01/0/0.19, dsn=4.7.5, status=deferred (delivery temporarily suspended: Cannot start TLS: handshake failure)
Aug 10 18:56:09 grommunio postfix/error[15078]: D218C1922: to=<fs@xxx.de>, relay=none, delay=0.79, delays=0.41/0.01/0/0.36, dsn=4.7.5, status=deferred (delivery temporarily suspended: Cannot start TLS: handshake failure)

My understanding of the Postfix configuration is, that it is trying to forward the email to the virtual_transport, which is configured in /etc/gromox/smtp.cfg.
Following a posting I found in this forum, I added "tls_min_proto=tls1.2" to this file and restarted all services - no success.
I tried "smtp_use_tls = no" and "smtp_tls_security_level = may" - no success.
All currently available updates are installed.
Does anyone have an idea how to fix this?

Thanks for any hints or suggestions,
Stefan

WalterH

Try: smtpd_use_tls = yes and smtpd_tls_security_level = may and restart postfix

smguenther

Hi,
the two parameters already have the suggested values. And since Postfix tries to forward the messages, shouldn't we think about smtp instead of smtpd settings?
Thanks for your help,
Stefan

WalterH

smtp is the sender and smtpd is the receiver task,

smguenther

And postfix wants to forward via the virtual_transport to Grommunio, therefore it is the sender = smtp?

WalterH

Yes Postfix uses smpt to send.

smguenther

Then why did you suggest smtpd parameters? The virtual transport is configured in /etc/gromox/smtp.cfg, right? It is possible to activate debugging for this service, to get more information about the communication between postfix and the transport?

smguenther

I compared each parameter of the main.cf of this installation with the another installation that did not have this problem. The following to parameters were the only difference and removing them solved the problem:

smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt

from the configuration solved the problem.