Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In Postfix, I have specified my private key, my certificate, and the certificate of my CA

smtpd_tls_CAfile     = /etc/ssl/cacert.pem
smtpd_tls_key_file   = /etc/ssl/server.key
smtpd_tls_cert_file  = /etc/ssl/server.pem

In dovecot, there are only options to specify my key and my cert:

ssl_cert = </etc/ssl/server.pem
ssl_key = </etc/ssl/server.key

How do I specify the certificate of my CA ?


The problem is, when I connect with client to my port 993, I get certificate error. Using openssl s_client -connect server:993 I get this error:

verify return:1
verify error:num=27:certificate not trusted
verify return:1
verify error:num=21:unable to verify the first certificate
verify return:1

I don't get this error when I connect to port 465 (Postfix):

openssl s_client -connect server:465
share|improve this question

2 Answers 2

up vote 4 down vote accepted

What you need is a chain certificate. You can create one like this:

cat /etc/ssl/server.pem /etc/ssl/cacert.pem > /etc/ssl/chain.pem

and then use the chain as the server certificate

ssl_cert = </etc/ssl/chain.pem
ssl_key = </etc/ssl/server.key

Now when you connect with openssl s_client, you should get no errors (provided everything else is set up correctly)

share|improve this answer

Certificate and key are needed if the application works as a SSL server, e.g. the certificate is the one presented to the client. A list of trusted CA is needed if the application works as an SSL client and thus needs to verify the certificate presented by the server.

While postfix works as both server (accepting mails) and client (delivering mail to another mail server) dovecot is only a server and thus does not need a list of trusted CAs.

share|improve this answer
please see my update –  Martin Vegter Jul 24 at 19:42
The CA setting for postifx is only used if postfix delivers mail, which is not the case in your example. You should get a similar error with postfix too because s_client has not default for CApath and therefore verification should fail. It might help if you would post the whole output of s_client for both cases to see what's going on. –  Steffen Ullrich Jul 24 at 19:53
I don't think what you say is correct. Apache also has parameter for CA certificate SSLCACertificateFile. –  Martin Vegter Jul 24 at 20:11
From apaches documentation: "SSLCACertificateFile...These are used for Client Authentication". I.e. it is used if the client authorizes itself using a certificate. For this case you have a ssl_ca setting (and others) in dovecot too, see wiki2.dovecot.org/SSL/DovecotConfiguration "Client certificate verification/authentication". Postfix uses smtpd_tls_CAfile setting both to verify client certificates when accepting and server certificates when delivering mail. But there are no client certificates involved in your example use with s_client. –  Steffen Ullrich Jul 24 at 20:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.