Bug 784198

Summary:	postfix configuration contains wrong value in smtp_tls_CApath
Product:	[openSUSE] openSUSE 13.1	Reporter:	Freek de Kruijf <freek>
Component:	YaST2	Assignee:	Peter Varkoly <varkoly>
Status:	RESOLVED DUPLICATE	QA Contact:	Jiri Srain <jsrain>
Severity:	Normal
Priority:	P5 - None	CC:	epperlein, jreidinger, suse-beta
Version:	Final
Target Milestone:	Final
Hardware:	x86-64
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Freek de Kruijf 2012-10-09 10:46:51 UTC

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1

When configuring postfix to use TLS on outgoing traffic to a relay host and that relay host has a certificate signed by a known CA, the value in smtp_tls_CApath, /etc/postfix/ssl/cacerts, points to a non existent directory. It should have the value /etc/ssl/certs

Reproducible: Always

Steps to Reproduce:
1. Look up the value of smtp_tls_CApath in /etc/postfix/main.cf it is /etc/postfix/ssl/cacerts . This is a non-exitent directory.
2. Traffic to the relay host is not going out
Actual Results:  
When changing that value to /etc/ssl/certs the traffic is going out.

Comment 1 Lutz Epperlein 2014-02-06 20:42:38 UTC

This bug is in OpenSuSE 13.1 yet.

Comment 2 Josef Reidinger 2014-02-07 20:33:08 UTC

reassign to yast2-mail-server maintainer, maybe duplicate?

Comment 3 Christian Boltz 2014-02-07 21:31:10 UTC

This is most probably caused by
    POSTFIX_SSL_PATH="/etc/postfix/ssl" 
in /var/adm/fillup-templates/sysconfig.postfix (aka /etc/sysconfig/postfix).

Lutz, can you please test if changing the path in /etc/sysconfig/postfix/ fixes the issue?

Comment 4 Lutz Epperlein 2014-02-17 19:34:03 UTC

(In reply to comment #3)
> This is most probably caused by
>     POSTFIX_SSL_PATH="/etc/postfix/ssl" 
> Lutz, can you please test if changing the path in /etc/sysconfig/postfix/ fixes
> the issue?

At first, sorry for the late answer.
No, changing the path wouldn't help, since YaST looks for the certs in POSTFIX_SSL_PATH/cacerts. What I've done, is using this command:
      ln -s /etc/ssl/certs /etc/postfix/ssl/cacerts
If I point POSTFIX_SSL_PATH to a folder containing a folder cacerts it works.