使用Postfix为邮件服务器设置TLS加密

Question

我正在尝试为我的postfix邮件服务器设置出站TLS加密。 我创建了一个CSR，它具有以下属性：

        Attributes:
    Requested Extensions:
        X509v3 Basic Constraints:
            CA:FALSE
        X509v3 Subject Key Identifier:
            F5:B0:EC:DF:81:32:10:12:DC:60:86:54:D2:03:77:5C:21:C2:EA:2B
        X509v3 Key Usage:
            Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement
        Netscape Cert Type:
            SSL Client, SSL Server, S/MIME, Object Signing

我将此CSR发送到证书颁发机构（GoDaddy），并且返回的证书具有以下属性：

X509v3 extensions:
        X509v3 Basic Constraints: critical
            CA:FALSE
        X509v3 Extended Key Usage:
            TLS Web Server Authentication, TLS Web Client Authentication
        X509v3 Key Usage: critical
            Digital Signature, Key Encipherment
        X509v3 CRL Distribution Points:

对于我的postfix main.cf文件：

### Client Side:
smtp_tls_security_level = may
smtp_use_tls = yes
smtp_tls_key_file = /etc/postfix/ca/mykey.pem
smtp_tls_cert_file = /etc/postfix/ca/mycert.pem
smtp_tls_CAfile = /etc/postfix/ca/gd_cacert.crt.pem
smtp_tls_loglevel = 3

但是，当我发送邮件并查看收到的邮件的来源时，标题看起来不像是有任何TLS加密：

Received: from ZZZZZZ by YYYYY with Microsoft SMTP Server (TLS)  via Mailbox Transport;
Received: from YYYYY by XXXXXX with Microsoft SMTP Server (TLS) ; 
Received: from XXXXX by office365  with Microsoft SMTP Server (TLS) id via Frontend Transport;
Authentication-Results: spf=none (sender IP is 000000 )
 smtp.mailfrom=postfixserver; dkim=none (message not signed) dmarc=none action=none header.from= postfixserver;
Received-SPF: None (postfix server does not designate permitted sender hosts)
Received: from postfixserver by office365  (1.1.1.1) with Microsoft SMTP Server (TLS)  via Frontend Transport;
Received: by postfixserver (Postfix, from userid 0)

我是否缺少任何可以使此功能正常工作的证书/配置设置？

Answer 1

你的Postfix main.cf配置看起来是正确的。很可能你已经通过TLS发送邮件，但你的下一跳没有在邮件标题中显示它。 发送给Microsoft（office365），gmail和yahoo时，我遇到了类似的问题，邮件标题并不表示我是通过TLS发送的，这是因为我与我的ssl证书不匹配。为了验证我还发送邮件给邮件服务器是内部部署的朋友。由于他们的邮件服务器未配置为从发件人中删除TLS，因此我使用TLS加密发送的标题显示但无法验证我的证书真实性。 我建议您确保您的证书通用名称与您的邮件服务器域名相匹配。