Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup my system to send emails via Gmail.

The system works in so far as I can send emails, however I'm getting an error regarding the secure certificate.

This is an example entry in the mail.log:

    Oct 29 12:17:27 durban postfix/smtp[20742]: setting up TLS connection

    Oct 29 12:17:27 durban postfix/smtp[20742]: certificate verification
    failed for[]:587: untrusted issuer
    /C=US/O=Equifax/OU=Equifax Secure Certificate Authority

    Oct 29 12:17:27 durban postfix/smtp[20742]: Untrusted TLS connection
    established to[]:587: TLSv1 with cipher
    RC4-SHA (128/128 bits)

    Oct 29 12:17:29 durban postfix/smtp[20742]: BA4852A1BFA:
    delay=2.9, delays=0.1/0.1/1.3/1.4, dsn=2.0.0, status=sent (250 2.0.0
    OK 1319887049 l20sm20686943wbo.6)

I googled this issue and have found others with the problem who were able to solve it by updating a file called cacert.pem in the /etc/postfix directory.

In my I have the following line (amongst others):


I have this file:

-rw-r--r-- 1 root root 2298 2011-10-29 12:16 cacert.pem

I populated this file with the commands:

# cat /usr/lib/ssl/certs/Equifax_Secure_CA.pem >> /etc/postfix/cacert.pem
# cat /usr/lib/ssl/certs/Thawte_Premium_Server_CA.pem >>

I believe the first line should suffice and the second line (certificate) is an old no longer used (by google) certificate.

I don't know what else I can change and don't have any idea on what else to search for or which logfiles to check.

Any hints appreciated.

share|improve this question

I had the same issue and when I issued "postconf |grep smtp|grep CA" all the variables were empty: smtp_tls_CAfile = smtp_tls_CApath = smtpd_tls_CAfile = smtpd_tls_CApath =

Here's how I fixed it;

I assume your Ubuntu install created the CA path that contains all known CAs on the internet: /etc/ssl/certs, and Equifax is there.

All you're missing in your Postfix configuration is the CApath: smtp_tls_CApath = /etc/ssl/certs

Afterwards Postfix will be able to verify's certificate as legit CA because it has it in the /etc/ssl/certs directory.

share|improve this answer
Quick and easy way to add this when you are in a hurry sudo postconf -e 'smtp_tls_CApath = /etc/ssl/certs' then sudo service postfix restart – Phil Sep 5 '13 at 18:14
The CApath setting is not useful if the smtp daemon runs in a chroot jail, which it usually does. – davmac Jan 25 '15 at 11:56

I think your problem is that you're setting smtpd_tls_CAfile instead of smtp_tls_CAfile.

You can use a self-signed certificate for your postfix TLS configuration.

share|improve this answer

I have the same configuration as you. But in addition to


I also have in my postfix's


Try adding this extra line. You might need to add it as part of this block:

smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_tls_cert_file = /etc/postfix/FOO-cert.pem
smtp_tls_key_file = /etc/postfix/FOO-key.pem
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
smtp_use_tls = yes
share|improve this answer

I had a similar problem, which I fixed with the help of this blogpost.

The remedy seemed to be that I just needed a valid SSL certificate (not a self-signed one), and I concatenated the StartSSL and Equifax CA bundles together.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.