# Postfix/TLS - Testing

Testing the package is a little bit difficult, as the communication is encrypted, so that you cannot "imitate" the conversation just by telnetting to the SMTP port. You also cannot capture the packets (well, you can, but if everything is working as advertised, it won't help you :-).

## Included debugging aids

As all of the messages generated by Postfix are sent to the syslog facility, debugging must be done using your normal system logfiles. Postfix/TLS supports the logging levels 0 (very quiet) up to 4 (a dump of the complete conversation, not recommended).

As a first step set `smpt[d]_tls_loglevel=2` and watch the logfile. Typically you will have problems with the access to the keys or certificates, so you will find error messages here.

You can always try to send an email to `postfix_tls-bounce@serv01.aet.tu-cottbus.de` with TLS enabled at your side and watch, what is going to happen :-)

While testing the interoperability with ZMailer we learned, that an incorrect certificate type (must be server for the server :-) can lead to connection failures without clear symptoms. It helps to use Netscape 4.5x as a client and carefully study the message boxes and certificate information. I have yet to find out how to identify this problem from postfix to print a suitable warning to the logfile. Hopefully it will be possible without changes in the OpenSSL library.

## Platforms

- Development Platform:
  - OS: HP-UX 10.20
  - OS: Linux 2.x (SuSE Linux)
- Test Client:
  - Software: Netscape 4.5x, Netscape 4.6x, Netscape 4.7x
  - OS: HP-UX 10.20, Linux 2.x, Win95

Please don't comment on the stability of Netscape, especially not on HP-UX...

## Interoperability

Besides support by generic wrapper solutions, there exist specially crafted extensions for other MTAs:

- Qmail There is an OpenSource patch available, extending the Qmail [QMAIL] MTA to support RFC2487, written by Frederik Vermeulen [QMAILTLS]. Sending and receiving is working from both sides.

  Testing: send mail to `ping@linux.student.kuleuven.ac.be` (will send back complete email including headers).

- Zmailer The author/maintainer of ZMailer, Matti Aarnio, has incorporated both server and client side TLS support [ZMAILER].

  Zmailer -> Postfix works fine,
  Postfix -> Zmailer does not work, since ESMTP is not recognized (problem reported).

  Testing: send mail to `autoanswer@mea.tmt.tele.fi` (will send back headers).

- Sendmail The commercial verson of sendmail supports client and server TLS, both sides interoperating with Postfix/TLS. As of sendmail-8.11, TLS is also included with the opensource version [SENDMAIL].

  Testing: send mail to `bounce@esmtp.org` (will bounce error message including old headers).

- Postfix Can send emails to itself :-).

  Testing: send mail to `postfix_tls-bounce@serv01.aet.tu-cottbus.de` (will bounce back, includes old headers).

Other reports are welcome.

## Known interoperability problems

- Postfix/TLS server: Under Win95/NT I have some problems with the client certificates. When opening the first connection (and Netscape asks for the password to access the certificate database), the connection hangs. This seems to be caused by Netscape: a dump of the communication shows, that Netscape just does not resume the TLS handshake.
  Remark:I could not reproduce this bug recently after upgrading OpenSSL 0.9.4. I hope it has vanished, but maybe it is just a consequence of playing around with Netscape's security options. More testing required...
  Workarounds: kill this connection, the next one will work immediately or use SSLv2 only (second workaround not recommended).

  Should finally be fixed with OpenSSL 0.9.5.

- Postfix/TLS server: Outlook Express as of Internet Explorer 5 will work with Postfix/TLS, but it will not present any client certificate. So you can encrypt your email transfer but you cannot authenticate (and relay) with client certificates. It only works on port 25 (smtp); on other ports you must use smtpd_tls_wrappermode instead. [Microsoft Knowledgebase]
- Postfix/TLS server: Outlook Express as of Internet Explorer 4 does not support RFC2487. Use smtpd_tls_wrappermode=yes on a different port(!) (465=smpts?) instead.
- Postfix/TLS server: Outlook Express (Mac) seems not to support RFC2487, you must use smtpd_tls_wrappermode on a different port(!) (465=smtps?) instead.
- Postfix/TLS client: MS Exchange also in recent versions (5.5) offers STARTTLS even if not configured (from the mailing list [IETF-APPS-TLS]). I could not test this without access to such server, so I cannot predict what is going to happen.
- Postfix/TLS client: TLS connections to a CommunigatePro server fail with a handshake error with older versions of CommunigatePro. Reason is a protocol violation of the CommunigatePro server with respect to SSL-protocol version numbering. The respective part of the protocol is the specification of the client_version in section 7.4.7.1. of RFC2246.
  This problem has been fixed in CommunigatePro 3.3b?? (don't know the exact numbering) around June 09, 2000.