postfix: Server certificate is used as client certificate too

[asbachb]

The server certificate is also used as client certificate:

# grep -r 'smtpd_tls_' /etc/postfix/*
/etc/postfix/main.cf:smtpd_tls_CAfile = 
/etc/postfix/main.cf:smtpd_tls_cert_file = /var/cert/domain.xyz/cert.pem
/etc/postfix/main.cf:smtpd_tls_key_file = /var/cert/domain.xyz/key.pem
...

# grep -r 'smtp_tls_' /etc/postfix/*
/etc/postfix/main.cf:smtp_tls_CAfile = 
/etc/postfix/main.cf:smtp_tls_cert_file = /var/cert/domain.xyz/cert.pem
/etc/postfix/main.cf:smtp_tls_key_file = /var/cert/domain.xyz/key.pem
...

Do not configure client certificates unless you must present client TLS certificates to one or more servers. Client certificates are not usually needed, and can cause problems in configurations that work well without them.
http://www.postfix.org/postconf.5.html#smtp_tls_cert_file

see

nixpkgs/nixos/modules/services/mail/postfix.nix

Lines 775 to 777 in e92b11d

	smtp_tls_CAfile = cfg.sslCACert;
	smtp_tls_cert_file = cfg.sslCert;
	smtp_tls_key_file = cfg.sslKey;

Downstream bug: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/183

[asbachb]

cc: @rickynils @globin

[flokli]

Could you file a PR fixing this?

You can add a release note entry, explaining how to get back to the old behaviour if someone is using this on purpose, but this really sounds like a bug.

[asbachb]

@flokli I currently working on a fix. The plan was to deprecate sslCACert, sslCert and sslKey and introduce something like tlsServerCACert, tlsClientCACert and so on.
But this takes some time since I'm not fluent with nix yet.

In addition I saw that postfix does not configure a trust store by default. Which prevent tls certification validation on server to server mail delivery.
I guess the best default configuration would be to trust the system trust store and enable opportunistic tls communication for server to server communication. Otherwise we promote the unencrypted smtp communication which should die asap.

[stale]

I marked this as stale due to inactivity. → More info