[GH-ISSUE #1428] Untrusted TLS connection established ... #1132

New issue

Closed

opened 2026-02-27 11:15:28 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 11:15:28 +03:00

Owner

Originally created by @Gravity-87 on GitHub (Mar 6, 2018).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1428

Impacted versions

Modoboa: 1.10.3
installer used: Yes
Webserver: Nginx
Postfix: v3.1.6 (Debian 9 stable)

Steps to reproduce

Current behavior

Sometimes I have log-messages like:

postfix/smtp[xxxxx]: Untrusted TLS connection established to xyz.domain.tld[xx.yyy.xx.xx]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)

Expected behavior

I don't know. I just want to ask, if these messages are a hint for an assumed mal-configuration in the modoboa-mailserver or not (= it simply happens and it's OK)? Researching the internet, I found the following hint:

If you have this bug, add this 2 lines on your /etc/postfix/main.cf (Debian, Ubuntu…):
smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_CApath = /etc/ssl/certs

Would you recommend this modification in /etc/postfix/main.cf or will this depend on another aspects, not yet considered here?

Video/Screenshot link (optional)

Originally created by @Gravity-87 on GitHub (Mar 6, 2018). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1428 # Impacted versions * Modoboa: 1.10.3 * installer used: Yes * Webserver: Nginx * Postfix: v3.1.6 (Debian 9 stable) # Steps to reproduce # Current behavior Sometimes I have log-messages like: > postfix/smtp[xxxxx]: Untrusted TLS connection established to xyz.domain.tld[xx.yyy.xx.xx]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) # Expected behavior I don't know. I just want to ask, if these messages are a hint for an assumed mal-configuration in the modoboa-mailserver or not (= it simply happens and it's OK)? Researching the internet, I found the following hint: > If you have this bug, add this 2 lines on your /etc/postfix/main.cf (Debian, Ubuntu…): smtp_tls_CApath = /etc/ssl/certs smtpd_tls_CApath = /etc/ssl/certs Would you recommend this modification in /etc/postfix/main.cf or will this depend on another aspects, not yet considered here? # Video/Screenshot link (optional)

kerem closed this issue

2026-02-27 11:15:28 +03:00

kerem commented

2026-02-27 11:15:28 +03:00

Author

Owner

@ghost commented on GitHub (Mar 6, 2018):

You only need to add smtp_tls_CApath to main.cf to fix these log messages

smtp_tls_CApath = /etc/ssl/certs

@ghost commented on GitHub (Mar 6, 2018): You only need to add `smtp_tls_CApath` to `main.cf` to fix these log messages ``` smtp_tls_CApath = /etc/ssl/certs ```

kerem commented

2026-02-27 11:15:28 +03:00

Author

Owner

@Toniob commented on GitHub (Mar 6, 2018):

Or it could just mean that the peer is using a self-signed certificate or that the hostname doesn't match with the certificate.

@Toniob commented on GitHub (Mar 6, 2018): Or it could just mean that the peer is using a self-signed certificate or that the hostname doesn't match with the certificate.

kerem commented

2026-02-27 11:15:28 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 7, 2018):

I think that's something we can add to the configuration deployed by the installer.

@tonioo commented on GitHub (Mar 7, 2018): I think that's something we can add to the configuration deployed by the installer.

kerem referenced this issue

2026-02-27 12:09:32 +03:00

[PR #1136] [MERGED] Fixed notifications. #2130