TLS Certificates for SMTP

TLS certificates in general serve two different purposes. They are used to encrypt communication and verify the authenticity of a server. Most mail servers will continue an encrypted mail transfer even if the authenticity cannot be established, meaning that the hostname does not match the Subject Alternative Name of the certificate. It is, however, recommended to always use certificates which match the hostname.

Prerequisites

Postfix requires a certificate and a key as two separate files in PEM format. Please see postfix TLS config. You will need SSH access to all MTA machines and sudo / root privileges. Four steps are required to use the custom TLS certificates.

Copying certificates to the MTAs

Save your custom certificate files on each MTA in a dedicated folder as tls.crt (certificate) and tls.key (private key). The recommended path is /etc/xorlab/tls. The files must be readable by user ag_mta (uid: 2020, gid: 2020). It is recommended that the private key is readable by this user only.

admin@mta1:/etc/xorlab/tls$ ll
-r-------- 1 ag_mta ag_mta 3456 Dec  2 03:04 tls.crt
-r-------- 1 ag_mta ag_mta 1704 Dec  2 03:04 tls.key

Change the docker config

In /etc/xorlab/activeguard/docker-compose.yml add a bind mount to the mta service to map the folder on the host containing the certificates files to the mta container. You are free to choose any path inside the container, however, do not choose /etc/ssl/my_certs as this directory will be overwritten by the internal config service. In this example, we will use /etc/ssl/custom/:

mta:
    image: ${XOR_REGISTRY}/ag/mta:${MTA_VERSION}
    container_name: ag_mta
    volumes:
      - $TLS_CERT_DIR:/etc/ssl/custom/                   # add this line

In /etc/xorlab/activeguard/.env set the $TLS_CERT_DIR variable:

TLS_CERT_DIR=/etc/xorlab/tls

Change the postfix config

In the XCC Expert Editor, open the main.cf file located in activeguard/mta/startup_cfg/postfix_custom/.
Set smtpd_tls_cert_file and smtpd_tls_key_file parameters based on the chosen path above, in this case /etc/ssl/custom/:
smtpd_tls_cert_file=/etc/ssl/custom/tls.crt smtpd_tls_key_file=/etc/ssl/custom/tls.key
Click PUBLISH to deploy changes and add a comment to these edits, for example, Add custom TLS certificates.

After you have published your changes, you can either wait 10 minutes for the config to propagate to the MTAs or do a manual config reload in the core GUI on each MTA.

Restart postfix container

In order for the config changes to take effect, you need to restart the postfix container, ag_mta. For inline setups, it is recommended to stop the core scan sources first and wait for all emails to be processed as the emails will be moved to the Erroneous queue if the scan finishes while postfix is not running. For bcc setups, this is no concern as no emails are sent back from xorlab Security Platform core to postfix. The following commands stop postfix and restart the ag_mta container. Make sure to be in the /etc/xorlab/activeguard/ path when executing the Docker commands.

Restart the ag_mta container:

admin@mta1$ cd /etc/xorlab/activeguard/
admin@mta1$ docker exec ag_mta postfix stop
admin@mta1$ docker stop ag_mta && docker compose up -d
ag_mta
ag_db is up-to-date
ag_rspamd is up-to-date
ag_core is up-to-date
Starting ag_mta ... done

Check in the mail.warn and mail.err logs that there are no errors related to the TLS certificates.

​Prerequisites

​Copying certificates to the MTAs

​Change the docker config

​Change the postfix config

​Restart postfix container

Prerequisites

Copying certificates to the MTAs

Change the docker config

Change the postfix config

Restart postfix container