I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was:

cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \
              sudo tee -a /etc/postfix/smtp_cacert.pem

When I read something like this, I get a little concerned, because I'm not entirely sure what happens if I append the Thawte .pem to mine. I built the .pem with:

openssl req -new -x509 -days 365 -nodes -out smtp_cacert.pem \
             -keyout smtp_cacert.key`...
  • What is the risk of appending the Thawte .pem on the one I generated?
  • What functionally is this doing to SSL when I append the Thawte .pem to mine?

The correct order for combining multiple PEM files is:

the correct PEM order is as follows:

(Your Private Key: your_domain_name.key)
(Your Primary SSL certificate: your_domain_name.crt)
(Your Intermediate certificate: IntermediaryCA.crt)
(Your Root certificate: TrustedRoot.crt)

Any of them you don't have (or don't want to be contained in one file) can be omitted. But the order goes from most specific to least specific.

  1. Key
  2. Your cert
  3. Intermediary CA cert
  4. Root CA cert

If there are multiple intermediaries just keep listing them in order, in the same order as the chain.

Not all programs require this order, some will figure it out on their own. But I've experienced both Postfix and stunnel require this order.


What is the risk of appending the Thawte .pem on the one I generated?


What functionally is this doing to SSL when I append the Thawte .pem to mine?

Placing multiple items in the same file makes them all available to the SSL library for initiating connections. Specifically, if one or more certificates signed the certificate that corresponds to the private key you're using, then those additional (typically "intermediate") certificates will be sent to the connecting client to aid in establishing a chain of trust from some trusted root installed on the client's computer and the certificate you're using to secure your session.

Like this:

[ Trusted root ] --signed--> [ Intermediate ] --signed--> [ Your Cert ]

If the client doesn't have a copy of the intermediate certificate, he can't make the link between the trusted root and your cert. If you provide it during SSL negotiation then he won't need to have already received a copy.

  • Thank you for answering the questions I asked. My certificate was self-signed. Under this circumstance, why should I append the Thawte cert to it? Thawte should not need to be anywhere in the certificate chain, right? – Mike Pennington Aug 4 '13 at 6:35
  • If your cert is self signed, I don't see the thawte certificate being particularly relevant. Why do you even have it? – tylerl Aug 4 '13 at 6:57
  • That's part of my question... It didn't seem like it needs to be in my .pem. The blogger had it appended to /etc/postfix/cacert.pem, but I didn't know where that came from so I built my own .pem. Thanks for helping me understand the bigger picture. I'm going to accept this answer. – Mike Pennington Aug 4 '13 at 7:06

All you're doing is creating a chain of certificates when you concatenate them together like this. This SO Q&A explains the formats of the various files, titled: What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?. It's probably the best explanation of the different file formats I've seen.


  • .pem Defined in RFC's 1421 through 1424, this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. The name is from Privacy Enhanced Email, a failed method for secure email but the container format it used lives on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.