Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a VPS with Ubuntu 12.04 server, I have install and configure postfix.

For the SMTP-AUTH I used the mail-stack-delivery package (previously packaged as dovecot-postfix).

sudo apt-get install mail-stack-delivery

After that in /etc/postfix/ I have these two lines:

smtpd_tls_cert_file = /etc/ssl/certs/server.crt

smtpd_tls_key_file = /etc/ssl/private/server.key

My question is these files server.crt and server.key are ok OR I have to create others with the openssl (a Self-Signed Certificate).

share|improve this question
Hmm... There's a SnakeOil cert/key that should not be used. I'm not sure about /etc/ssl/certs/server.crt. Do you even have that cert/key (or is it a place holder)? Can you post /etc/ssl/certs/server.crt with your question? Or perhaps its thumbprint with openssl x509 -fingerprint -in /etc/ssl/certs/server.crt? – user207039 Mar 31 '14 at 19:29
up vote 1 down vote accepted

Answer is dependent. In some cases can you do just fine with the generated ones. But the best practice and my strongest advice is to generate new ones. That because some clients or servers might reject to deliver when the common name or domain tag on your server certificates doesn't match the destination they are trying to deliver to. Also if you have clients with the right version of outlook, will they be nagged with a warning they can't get rid off unless you create a correct certificate and install the public part or CA on the client.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.