How to Install an SSL Certificate on Postfix

In this tutorial, you will learn how to install an SSL/TLS certificate on Postfix, the popular Linux mail transfer agent.

We also recorded a video that walks you through the entire process. Watch it below, or keep reading for the text version.

Generate a CSR code on Postfix

If you have already generated your CSR code and only need the installation steps, skip ahead to Install an SSL Certificate on Postfix.

To obtain an SSL certificate from a trusted CA (Certificate Authority), you must submit a CSR (Certificate Signing Request). A CSR is a block of encoded text that contains your contact and organization details. You have two options:

• Use our CSR Generator to create the CSR automatically.
• Follow our step-by-step tutorial on how to generate a CSR in Postfix.

During the order process with your SSL vendor, open the CSR file in any plain-text editor and copy-paste the entire block, including the —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—– lines, into the corresponding box. Once the CA validates your request and issues the certificate, continue with the installation below.

Install an SSL certificate on Postfix

After the CA validates your request and sends the certificate files to your inbox, you can begin the installation.

Step 1: Prepare your SSL files

Postfix uses SSL/TLS certificates in X.509 format. A correct installation needs three files:

• Your private key, generated together with the CSR on your server (for example privkey.key).
• Your primary SSL certificate, the file inside the ZIP archive the CA emailed you. In this guide we’ll refer to it as server.crt.
• The intermediate certificate(s), the CA bundle from the same ZIP archive. We’ll refer to it as intermediate.pem.

You can keep all three files in a single directory, for example /etc/postfix/. Make sure the private key is readable only by root:

sudo chmod 600 /etc/postfix/privkey.key

Step 2: Build the certificate chain

How you assemble the files depends on your Postfix version. Check it first:

postconf mail_version

Recommended (Postfix 3.4 and newer)

Create one chain file that contains the private key, the server certificate, and the intermediate(s), in exactly this order:

cat /path/to/privkey.key /path/to/server.crt /path/to/intermediate.pem > /etc/postfix/rsachain.pem

This modern method avoids certificate-rollover issues and works cleanly with Postfix’s smtpd_tls_chain_files directive. Protect the chain file the same way as the key, since it contains your private key:

sudo chmod 600 /etc/postfix/rsachain.pem

Alternative (all Postfix versions)

If you run a Postfix version older than 3.4, keep the key separate and combine only the server certificate with the intermediate(s):

cat /path/to/server.crt /path/to/intermediate.pem > /etc/postfix/server.pem

You’ll reference this bundle and the private key separately in the configuration below.

Step 3: Configure Postfix

Open the main configuration file /etc/postfix/main.cf and choose the style that matches your setup.

Option A: Postfix 3.4 or newer (recommended). Point Postfix at the single chain file you built:

smtpd_tls_chain_files = /etc/postfix/rsachain.pem
smtpd_tls_security_level = may

Option B: legacy (Postfix older than 3.4). Reference the certificate bundle and key separately:

smtpd_tls_cert_file = /etc/postfix/server.pem
smtpd_tls_key_file = /etc/postfix/privkey.key
smtpd_tls_security_level = may

A few notes on these directives:

• smtpd_tls_security_level = may enables opportunistic TLS for inbound mail on port 25. This is the correct setting for a public MX server: it advertises STARTTLS to senders that support it, while still accepting plain connections from those that don’t. Do not set it to encrypt on a public MX, as that would reject legitimate mail from plain-only senders. (The old smtpd_use_tls = yes switch is deprecated; smtpd_tls_security_level replaces it.)
• Use a full-chain certificate (your certificate plus the intermediates), whether you deliver it via smtpd_tls_chain_files (Option A) or smtpd_tls_cert_file (Option B). Serving only the leaf certificate causes chain-validation failures on the receiving end.
• Modern Postfix already disables SSLv2, SSLv3, and weak ciphers by default, so you don’t need extra exclusion lists for inbound port-25 traffic.

Secure the submission service (port 587)

When your own users send mail through Postfix (via Outlook, Thunderbird, Apple Mail, and so on), they connect on the submission port 587, not port 25, which is reserved for server-to-server delivery. Because only your authenticated users use this port, you can safely enforce stricter rules: require TLS and set a minimum protocol of TLS 1.2.

Open /etc/postfix/master.cf, make sure the submission service is enabled, and add the overrides below:

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_mandatory_protocols=>=TLSv1.2

A couple of details that trip people up:

• smtpd_tls_mandatory_protocols only takes effect when the security level is encrypt (mandatory TLS), which is exactly the case here on port 587. For opportunistic TLS on port 25 (security level may), the equivalent knob would be smtpd_tls_protocols instead, but on a public MX you generally leave that at Postfix’s defaults so you don’t turn away older senders.
• The compact >=TLSv1.2 syntax requires Postfix 3.6 or newer and must have no space between >= and the version. On Postfix 3.4 or 3.5, use the exclusion form instead: smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1.
• In master.cf, there is no space around the = in an -o override (for example -o smtpd_tls_security_level=encrypt), whereas in main.cf you write key = value with spaces.

Optional: implicit TLS on port 465. Many modern clients prefer port 465 (SMTPS / “submissions”), which wraps the whole session in TLS from the start. RFC 8314 endorses it alongside 587. To offer it, enable the smtps service in master.cf with wrapper mode:

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes

Step 4: Reload Postfix

Before reloading, it’s good practice to check the configuration for syntax mistakes:

sudo postfix check

If that returns nothing, apply the changes. A reload re-reads the configuration without interrupting active connections:

sudo systemctl reload postfix

On systems without systemd, the equivalent command is:

sudo postfix reload

Step 5: Verify the certificate

Confirm that Postfix is serving the correct certificate and chain with OpenSSL. Replace yourdomain.com with your mail server’s hostname:

openssl s_client -starttls smtp -connect yourdomain.com:25 -servername yourdomain.com </dev/null \
| openssl x509 -noout -issuer -subject -dates

The output should show your server certificate’s subject, its issuer (the CA), and the validity dates. To test the submission service instead, change the port to 587 (it also uses STARTTLS) or, for the implicit-TLS port 465, drop -starttls smtp and connect to port 465 directly. Congratulations, you’ve successfully installed an SSL certificate on Postfix.

Test your SSL installation

After installing the certificate, it’s wise to scan your configuration for errors or vulnerabilities. Our SSL Checker give you instant reports on every aspect of your certificate and its setup, so you can confirm the chain is complete and the protocols are configured correctly.

Where to buy the best SSL certificate for Postfix?

You’ve reached the right place. At SSL Dragon, we offer one of the widest ranges of SSL products at some of the lowest prices on the market, and all our certificates are compatible with the Postfix mail transfer agent.

Not sure which certificate to choose? Our SSL Wizard make it quick and easy to find the right product for your mail server.

Frequently Asked Questions

Bottom line

Installing an SSL certificate on Postfix comes down to assembling a full-chain PEM file, pointing main.cf at it with smtpd_tls_chain_files (or the legacy smtpd_tls_cert_file / smtpd_tls_key_file pair), setting smtpd_tls_security_level = may for inbound mail, hardening the submission service on port 587, checking the config with sudo postfix check, and reloading Postfix.

Need a certificate first? Browse our SSL certificates.