From 05a32efa5069fb6f4d9646cf22573f3ebfa44e09 Mon Sep 17 00:00:00 2001 From: link2xt Date: Sun, 16 Mar 2025 10:41:55 +0000 Subject: [PATCH] fix: send SNI when connecting to outside servers Otherwise email providers which allow to bring your own domain and use the same IP addresses for all customers send wildcard certificate instead of the correct one and Postfix refuses to connect with an error server certificate verification failed for example.org[A.B.C.D]:25: num=62:hostname mismatch --- CHANGELOG.md | 3 +++ cmdeploy/src/cmdeploy/postfix/main.cf.j2 | 3 +++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4208b0a8..9c8f5ae0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ ## untagged +- Send SNI when connecting to outside servers + ([#524](https://github.com/chatmail/server/pull/524)) + - Pass through `original_content` instead of `content` in filtermail ([#509](https://github.com/chatmail/server/pull/509)) diff --git a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 b/cmdeploy/src/cmdeploy/postfix/main.cf.j2 index 33ab5719..19ca1437 100644 --- a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 +++ b/cmdeploy/src/cmdeploy/postfix/main.cf.j2 @@ -21,6 +21,9 @@ smtpd_tls_security_level=may smtp_tls_CApath=/etc/ssl/certs smtp_tls_security_level=verify +# Send SNI extension when connecting to other servers. +# +smtp_tls_servername = hostname smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_policy_maps = inline:{nauta.cu=may} smtpd_tls_protocols = >=TLSv1.2