Home / server / Questions / 270356
Accepted
Tiddo
Asked: 2011-05-17 13:56:27 +0800 CST

postfix to gmail error

  • 772

I've set up a server with postfix for sending mails. However, when I try to send an email to a gmail account, I get the following errors:

May 16 23:41:47 vps4195 postfix/smtp[15949]: certificate verification failed for gmail-smtp-in.l.google.com: num=20:unable to get local issuer certificate
May 16 23:41:47 vps4195 postfix/smtp[15949]: certificate verification failed for gmail-smtp-in.l.google.com: num=27:certificate not trusted

After these errors the mail is delivered to the gmail accounts, but the mail will almost always go to the spam directory, even when no mail filter is used inside gmail.

So how can I get rid of these errors?

ps. Probably this isn't enough information for you to help me fix this, but I'm not really an expert on this subject, so please tell me if I need to post more information.

edit: The system postfix is running on is CentOS 5.5 (VPS)

postfix gmail

2 Answers

  1. Best Answer

    These two errors are unrelated.

    • The first is an indication that you don't have installed the necessary root certificates to reliable check the identity of Google's servers, but are nevertheless trying to use SSL encrypted SMTP. You have two options, the first being to deactivate SSL for mail delivery, which is IMHO an acceptable solution if you don't use Google's server as a mail relay. The second would be to install the certificate chain for Google's servers, or even better a full stack of SSL root certificates and tell Postfix where to find them. How this is done is a little bit dependent on the system you are using Postfix on, which you don't name.
    • The second error is an indication that your mail system is badly configured and Google's spam filter just consider mails from your system as spam. This might have multiple reasons, among them that you might be an open relay, that your DNS entries are incorrect or you might listed in some DNSBL lists (for being an open relay or for sending out spam). You will find a multitude of questions on ServerFault that deals with those topics.
    • 5

  2. Google switched the Certificate to Equifax.

    You can download the certificate from: https://www.geotrust.com/resources/root-certificates/index.html (download the Root 1 - Equifax Secure Certificate Authority as DER encoded X.509)

    After downloading it you have to convert it to a pem:

    openssl x509 -inform der -in Equifax_Secure_Certificate_Authority_DER.cer -out Equifax_Secure_Certificate_Authority_DER.pem

    Now you can verfiy the certificate:

    openssl verify Equifax_Secure_Certificate_Authority_DER.pem

    Last you have to add the pem to your certificate folder. In Debian this is /etc/ssl/certs

    I also added it to /etc/ssl/certs/ca-certificates.crt with

    cat Equifac_Secure_Certificate_Authority_DER.pem >> /etc/ssl/certs/ca-certificates.crt

    and include this crt in my postfix configuration:

    smtpd_tls_CAfile=/etc/ssl/certs/ca-certificates.crt
smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt
    • 1