koldfront

Postfix client certificate #email #postfix

Most of the time my laptop is at home - and Postfix on my laptop sends email via Postfix on my mail server, configured as the relayhost - which is allowed because the local network is included in permit_mynetworks on the mail server.

Sometimes I bring my laptop somewhere else. I can still read email, but until today I couldn't send, because the laptop is not on the local network.

A solution is to set up a client certificate on the laptop and configure the server to accept it, so that's what I did.

On the server I installed the mkcert package and ran mkcert -install. Then I created a client certificate for the laptop by running mkcert -client tullinup.koldfront.dk (also on the server). I copied the resulting certificate and private key to the laptop.

On the server I made a couple of changes to the Postfix configuration, in /etc/postfix/main.cf I added:

smtpd_tls_ask_ccert = yes
relay_clientcerts = hash:/etc/postfix/relay_clientcerts

and to the lists smtpd_recipient_restrictions and smtpd_relay_restrictions I put in permit_tls_clientcerts, after permit_sasl_authenticated,.

I created a new file /etc/postfix/relay_clientcerts in which I put the sha256 fingerprint of the client certificare followed by the name of the laptop, separated by a space. The fingerprint was found by running openssl x509 -noout -fingerprint -sha256 -in tullinup.koldfront.dk-client.pem. After creating the file I ran postmap on it as root.

To finish the server configuration I restarted the postfix service while monitoring the logfile for any oddities.

On the laptop I put the newly generated client certificate and key in /etc/postfix/certs (owned by root:root), and then in /etc/postfix/main.cf I added the lines:

smtp_tls_cert_file = /etc/postfix/certs/tullinup.koldfront.dk-client.pem
smtp_tls_key_file = /etc/postfix/certs/tullinup.koldfront.dk-client-key.pem
smtp_tls_fingerprint_digest = sha256

and then restarted the postfix service on the laptop.

Just sent a couple of test emails - it works!

Resources consulted:

• Postfix client certificate verification, Dan Langille's Other Diary.
• Postfix TLS Support, Postfix documentation.
• mkcert.
• Postfix 2.10 client certificate-based relay, ServerFault question.
• How can I create a sha256 fingerprint in openssl, StackOverflow question.