POSTTLS-FINGER(1) General Commands Manual POSTTLS-FINGER(1) (NAME) posttls-finger - TLS ESMTP LMTP. (SYNOPSIS) posttls-finger [options] [inet:]domain[:port] [match ...] posttls-finger -S [options] unix:pathname [match ...] (DESCRIPTION) posttls-finger(1) TLS . SMTP LMTP inet: unix:. Postfix TLS posttls-finger(1) -a -c -h -o -S -t -T -v . : . . SMTP ESMTP EHLO . EHLO . posttls-finger(1) TLS STARTTLS TLS . DNSSEC TLS ( -l) dane TLS_README . secure . . TLS TLS (cipher) . ( ) . CA -L certmatch ( ) . SMTP . : posttls-finger(1) TLS . tlsmgr(8) ( Postfix) TLS . -r delay TLS TLS . posttls-finger(1) TLS . (load balancer) . EHLO . -r ( ) -m . SMTP LMTP ( -S) . SMTP host:service DNS MX ( ) [host] [host]:port . [] IP . IPv6 [ipv6:address] . SMTP smtp/tcp /etc/services . LMTP unix:pathname inet: domain SMTP . TCP LMTP . : -a family (: any) : ipv4 ipv6 any. any posttls-finger(1) MX . -A trust-anchor.pem (: ) (trust-anchor) PEM CAfile CApath . . main.cf smtp_tls_trust_anchor_file . -c SMTP TLS . -C SMTP PEM. (issuer DN) (subject DN) ( -d mdalg ) PEM . -F CAfile -P CApath OpenSSL . SMTP CAfile CApath . -d mdalg (: $smtp_tls_fingerprint_digest) (message digest) SMTP ( DANE TLSA DNS ). Postfix 3.6 "md5" . -f (RRset) DANE TLSA (zone) . smtp_tls_force_insecure_host_tlsa_lookup . -F CAfile.pem (: ) CAfile PEM SMTP . CAfile CA . -g grade (: medium) (cipher grade) TLS posttls-finger(1). smtp_tls_mandatory_ciphers . -h host_lookup (: dns) . smtp_host_lookup . -H chainfiles (: none) TLS PEM. . . . -k -K . -k certfile (: keyfile) TLS PEM. keyfile . -K keyfile (: certfile) TLS PEM. certfile . -l level (: dane secure) DNSSEC dane secure . smtp_tls_security_level . dane dane-only TLSA secure . fingerprint . posttls-finger(1) none may encrypt . may encrypt TLS SMTP TLS ( TLS ). -L logopts (: routine,certmatch) TLS. TLS TLS : 0, none TLS : $ posttls-finger -cC -L none destination 1, routine, summary TLS . 2, debug routine ssl-debug cache verbose . 3, ssl-expert debug ssl-handshake-packet-dump . . 4, ssl-developer ssl-expert ssl-session-packet-dump . wireshark . ssl-debug SSL OpenSSL. . ssl-handshake-packet-dump SSL . ssl-session-packet-dump SSL SSL . untrusted . (CA) . . peercert SMTP . certmatch SMTP CN subjectAltName . DANE TLSA (end-entity) ..IP "cache" () SMTP . -r . verbose TLS Postfix peercert..cache . routine,certmatch . peercert certmatch verbose cache summary . -m count (: 5) -r delay -m (load balancer) . MTA EHLO . -M insecure_mx_policy (: dane) TLS MX TLSA <<>> (nexthop) dane MX MX <<>> . main.cf smtp_tls_dane_insecure_mx_policy . -o name=value name main.cf value . TLS <> SMTP EHLO . -p protocols (: >=TLSv1) TLS posttls-finger(1) . smtp_tls_mandatory_protocols . -P CApath/ (: ) CApath/ OpenSSL ( c_rehash(1)) SMTP . CApath (CA) . -r delay TLS delay . . -m . . -R SRV MX. -s servername (SNI) TLS. DANE TLSA TLSA . SNI . -S SMTP LMTP. LMTP TCP 24 . <<:servicename>> <<:portnumber>> . -t timeout (: 30) TCP . 220 . -T timeout (: 30) SMTP/LMTP EHLO/LHLO STARTTLS QUIT. -v Postfix. . -w (wrapper) TLS SUBMISSIONS/SMTPS. 465 STARTTLS SMTP-in-SSL . domain:port . -x (RPK) X.509 RFC7250. X.509 . smtp_tls_enable_rpk = yes smtp(8) . fingerprint ( ) match . . -X tlsproxy(8). . [inet:]domain[:port] TCP domain port. smtp ( 24 LMTP) . SMTP MX [] . MX mx1.example.com [mx1.example.com] example.com match . DNS (fully qualified) native ( dane dane-only DNSSEC native ). unix:pathname pathname. LMTP. match ... . fingerprint DNS verify secure . dane dane-only hostname, nexthop . (ENVIRONMENT) MAIL_CONFIG . MAIL_VERBOSE -v. (SEE ALSO) smtp-source(1), SMTP/LMTP smtp-sink(1), SMTP/LMTP.SH " README (README FILES)" <> <> . TLS_README Postfix STARTTLS (LICENSE) Secure Mailer . (AUTHORS) Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA Wietse Venema Google, Inc. 111 8th Avenue New York, NY 10011, USA Viktor Dukhovni POSTTLS-FINGER(1)