title: Postfix SMTP relay: client does not offer TLS client certificate to the server?
body: <p>I have two machines, one running Ubuntu and one runing Debian, both running Postfix. The intent is that machine#2 becomes a SMTP relay/smarthost for machine#1. I have created a CA and issued certificates for both of the machines: a server certificate for #2 and a client certificate for #1.</p>
  
  <p>When sending e-mail from #1 (by having the MUA talk to Postfix on localhost:25 with the intent that it relays e-mail to #2), the basic things work fine: the machines can talk to each other and an attempt to relay is actually made. The idea is to allow relaying on #2 if a valid client-side SSL/TLS certificate is presented from #1.</p>
  
  <p>The relevant configuration for #2 is:</p>
  
  <pre><code>smtpd_tls_received_header = yes
  smtpd_tls_loglevel = 2
  smtpd_use_tls = yes
  smtpd_tls_cert_file = /etc/ssl/private/cert2.pem
  smtpd_tls_key_file = /etc/ssl/private/key2-d.pem
  smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
  smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  smtpd_tls_mandatory_protocols = SSLv3, TLSv1
  smtpd_tls_mandatory_ciphers = medium
  smtpd_tls_auth_only = yes
  smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination permit_tls_all_clientcerts
  </code></pre>
  
  <p>The configuration on #1 is:</p>
  
  <pre><code>smtp_tls_CAfile = /etc/ssl/certs/cacert.pem
  smtp_tls_cert_file = /etc/ssl/private/cert1.pem
  smtp_tls_key_file = /etc/ssl/private/key1-d.pem
  smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  smtp_tls_security_level = verify
  smtp_tls_loglevel = 2
  </code></pre>
  
  <p>Machine#1 connects to #2, enables STARTTLS, the log files show that it successfuly verifies the certificate from #2, and attempts to relay the message. <em>However</em>, it appears not to send the client certificate to #2, and #2 refuses to relay the message.</p>
  
  <p>Log entries from #1:</p>
  
  <pre><code>Apr 17 01:18:14 mail1 postfix/smtp[30250]: Verified TLS connection established to mail2[x.x.x.x]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
  Apr 17 01:18:14 mail1 postfix/smtp[30244]: 8A2328BDB4: to=&lt;addr@gmail.com&gt;, relay=mail2[x.x.x.x]:25, delay=3488, delays=3486/0.41/0.85/0.19, dsn=4.7.1, status=deferred (host mail2[x.x.x.x] said: 454 4.7.1 &lt;addr@gmail.com&gt;: Relay access denied (in reply to RCPT TO command))
  </code></pre>
  
  <p>Log entries from #2:</p>
  
  <pre><code>Apr 17 01:18:13 mail2 postfix/smtpd[28798]: Anonymous TLS connection established from unknown[y.y.y.y]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
  Apr 17 01:18:13 mail2 postfix/smtpd[28798]: NOQUEUE: reject: RCPT from unknown[y.y.y.y]: 454 4.7.1 &lt;addr@gmail.com&gt;: Relay access denied; from=&lt;addr@mail1&gt; to=&lt;addr@gmail.com&gt; proto=ESMTP helo=&lt;mail1&gt;
  </code></pre>
  
  <p>Any ideas? I'm basing my assumption that #1 didn't send its client cert on the "Anonymous TLS connection established" part in the logs from mail2.</p>