Bonsoir,
Pour résumer, j'ai un problème avec postfix pour le relayer les mails sortant vers le smtp de gmail en utilisant TLS.
Lorsque je ne met pas smtp_enforce_tls a yes, lla session TLS est bien réalisée entre mon serveur est bien réaliée bien que le certificat présenté par gmail n'est pas vérifé. Les mails sont ensuite bien relayés.
En le mettant a yes, étant donné qu'il n'est pas vérifié, la session ne s'établit pas (logique).
Donc en gros j'ai un problème pour la vérification du certifcat de google.
Avec la commande
openssl s_client -connect smtp.gmail.com:995 -showcerts |
J'ai récupéré le certificat, je l'ai mis dans /etc/postfix/certs
j'ai créé le hash et j'ai fait un lien symbolique
J'ai fait pareil avec les certificats de Thawte* que j'ai trouvé dans /usr/share/ca-certs....
Mais je trouve rien dans les logs qui me dit qu'il chope les bon trucs pour valider le certif
Le postconf -n:
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = yes
config_directory = /etc/postfix
inet_interfaces = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = serveur.xxx.org, localhost.localdomain, localhost.localdomain, localhost, xxx.org
myhostname = xxx.org
mynetworks = 127.0.0.0/8
myorigin = /etc/mailname
recipient_delimiter = +
relayhost = smtp.gmail.com
smtp_enforce_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
smtp_tls_CApath = /etc/postfix/certs
smtp_tls_loglevel = 2
smtp_tls_scert_verifydepth = 0
smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_tls_loglevel = 2
smtpd_tls_session_cache_database = btree:/var/run/smtpd_tls_session_cache
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom |
Les logs du serveur:
Feb 7 21:56:31 mano postfix/smtp[17552]: initializing the client-side TLS engine
Feb 7 21:56:31 mano postfix/smtp[17552]: setting up TLS connection to gmail-smtp.l.google.com
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:before/connect initialization
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:SSLv2/v3 write client hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv2/v3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:SSLv3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server certificate A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server certificate A
Feb 7 21:56:31 mano postfix/smtp[17552]: certificate verification depth=0 subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com
Feb 7 21:56:31 mano postfix/smtp[17552]: certificate verification failed for gmail-smtp.l.google.com: num=20:unable to get local issuer certificate
Feb 7 21:56:31 mano postfix/smtp[17552]: verify return: 0
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL3 alert write:fatal:unknown CA
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server certificate B
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect error to gmail-smtp.l.google.com: -1
Feb 7 21:56:31 mano postfix/smtp[17552]: warning: TLS library problem: 17552:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:894:
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL session removed
Feb 7 21:56:31 mano postfix/smtp[17552]: 209AC3E45A: Cannot start TLS: handshake failure
Feb 7 21:56:31 mano postfix/smtp[17552]: setting up TLS connection to gmail-smtp.l.google.com
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:before/connect initialization
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:SSLv2/v3 write client hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv2/v3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:SSLv3 read server hello A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server certificate A
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server certificate A
Feb 7 21:56:31 mano postfix/smtp[17552]: certificate verification depth=0 subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com
Feb 7 21:56:31 mano postfix/smtp[17552]: certificate verification failed for gmail-smtp.l.google.com: num=20:unable to get local issuer certificate
Feb 7 21:56:31 mano postfix/smtp[17552]: verify return: 0
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL3 alert write:fatal:unknown CA
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect:error in SSLv3 read server certificate B
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL_connect error to gmail-smtp.l.google.com: -1
Feb 7 21:56:31 mano postfix/smtp[17552]: warning: TLS library problem: 17552:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:894:
Feb 7 21:56:31 mano postfix/smtp[17552]: SSL session removed
Feb 7 21:56:31 mano postfix/smtp[17552]: 209AC3E45A: to=<toto@truc.fr>, relay=gmail-smtp.l.google.com[66.249.93.109], delay=4258, status=deferred (Cannot start TLS: handshake failure) |
Quelqu'un aurait une idée ?
Message édité par o'gure le 29-08-2010 à 15:47:05
![[:god]](https://forum-images.hardware.fr/images/perso/god.gif "[:god]")
)
![[:petrus75]](https://forum-images.hardware.fr/images/perso/petrus75.gif "[:petrus75]")
![[:sisicaivrai]](https://forum-images.hardware.fr/images/perso/sisicaivrai.gif "[:sisicaivrai]")
C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
![[:zaib3k]](https://forum-images.hardware.fr/images/perso/zaib3k.gif "[:zaib3k]")
![[:j l b]](https://forum-images.hardware.fr/images/perso/j l b.gif "[:j l b]")