Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

In Postfix, I have specified my private key, my certificate, and the certificate of my CA

smtpd_tls_CAfile     = /etc/ssl/cacert.pem
smtpd_tls_key_file   = /etc/ssl/server.key
smtpd_tls_cert_file  = /etc/ssl/server.pem

In dovecot, there are only options to specify my key and my cert:

ssl_cert = </etc/ssl/server.pem
ssl_key = </etc/ssl/server.key

How do I specify the certificate of my CA ?


The problem is, when I connect with client to my port 993, I get certificate error. Using openssl s_client -connect server:993 I get this error:

verify return:1
verify error:num=27:certificate not trusted
verify return:1
verify error:num=21:unable to verify the first certificate
verify return:1

I don't get this error when I connect to port 465 (Postfix):

openssl s_client -connect server:465
share|improve this question

3 Answers 3

up vote 5 down vote accepted

What you need is a chain certificate. You can create one like this:

cat /etc/ssl/server.pem /etc/ssl/cacert.pem > /etc/ssl/chain.pem

and then use the chain as the server certificate

ssl_cert = </etc/ssl/chain.pem
ssl_key = </etc/ssl/server.key

Now when you connect with openssl s_client, you should get no errors (provided everything else is set up correctly)

share|improve this answer

In general the server offers to the requesting client the server certificate plus all intermediary certification authorities certificates so that the client can match the top certificate of the chain to one of his trusted (root) certificates. That is true for apache, dovecot and postfix. Dovecot doesn't seem to have a setting for the trust chain, so in this case the trust chain has to be merged with the server certificate and be pointed to by.

ssl_cert = </etc/ssl/server-plus-chain.pem

The order of the certificates is

  1. server cert
  2. intermediary certs

The last intermediary cert is issued by the trusted root cert the client has available.

share|improve this answer

Certificate and key are needed if the application works as a SSL server, e.g. the certificate is the one presented to the client. A list of trusted CA is needed if the application works as an SSL client and thus needs to verify the certificate presented by the server.

While postfix works as both server (accepting mails) and client (delivering mail to another mail server) dovecot is only a server and thus does not need a list of trusted CAs.

share|improve this answer
please see my update – Martin Vegter Jul 24 '14 at 19:42
The CA setting for postifx is only used if postfix delivers mail, which is not the case in your example. You should get a similar error with postfix too because s_client has not default for CApath and therefore verification should fail. It might help if you would post the whole output of s_client for both cases to see what's going on. – Steffen Ullrich Jul 24 '14 at 19:53
I don't think what you say is correct. Apache also has parameter for CA certificate SSLCACertificateFile. – Martin Vegter Jul 24 '14 at 20:11
From apaches documentation: "SSLCACertificateFile...These are used for Client Authentication". I.e. it is used if the client authorizes itself using a certificate. For this case you have a ssl_ca setting (and others) in dovecot too, see "Client certificate verification/authentication". Postfix uses smtpd_tls_CAfile setting both to verify client certificates when accepting and server certificates when delivering mail. But there are no client certificates involved in your example use with s_client. – Steffen Ullrich Jul 24 '14 at 20:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.