<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hallo Daniel,<div><br></div><div>danke für Deine Recherche. Habe extra Zertifikat für www.domain. (alles Letsencrypt). Könnte das auch mal zusammenfassen zu einem multidomain Zertifikat.</div><div><br></div><div>Bei TLS Konfig hätte ich jetzt Wissensprobleme. Das habe ich:</div><div><br></div><div><p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(50, 244, 241);"><span style="font-variant-ligatures: no-common-ligatures">##### TLS parameters ######</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures; color: #ebef18">smtpd_tls_cert_file</span><span style="font-variant-ligatures: no-common-ligatures"> = /var/lib/acme/.acme.sh/www.mydomain.org/fullchain.cer</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures; color: #ebef18">smtpd_tls_key_file</span><span style="font-variant-ligatures: no-common-ligatures"> = /var/lib/acme/.acme.sh/www.mydomain.org/www.mydomain.org.key</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(50, 244, 241);"><br></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtpd_use_tls</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000">=</span><span style="font-variant-ligatures: no-common-ligatures; color: #fb1eff">yes</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtpd_tls_auth_only</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000">=</span><span style="font-variant-ligatures: no-common-ligatures; color: #fb1eff">yes</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtpd_tls_session_cache_database</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000"> = </span><span style="font-variant-ligatures: no-common-ligatures; color: #80ffa7">btree</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000">:${</span><span style="font-variant-ligatures: no-common-ligatures">data_directory</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000">}/smtpd_scache</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtp_tls_session_cache_database</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000"> = </span><span style="font-variant-ligatures: no-common-ligatures; color: #80ffa7">btree</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000">:${</span><span style="font-variant-ligatures: no-common-ligatures">data_directory</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000">}/smtp_scache</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(0, 0, 0); min-height: 13px;"><span style="font-variant-ligatures: no-common-ligatures"></span><br></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtp_tls_security_level</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000"> = </span><span style="font-variant-ligatures: no-common-ligatures; color: #32f4f1"><b>may</b><b></b></span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures; color: #ebef18">smtp_tls_protocols</span><span style="font-variant-ligatures: no-common-ligatures"> = !SSLv2,!SSLv3,!TLSv1</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtp_tls_ciphers</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000"> = </span><span style="font-variant-ligatures: no-common-ligatures; color: #32f4f1"><b>high</b><b></b></span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; font-size: 11px; line-height: normal; font-family: Menlo; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; color: rgb(235, 239, 24);"><span style="font-variant-ligatures: no-common-ligatures">smtp_tls_loglevel</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000"> = </span><span style="font-variant-ligatures: no-common-ligatures; color: #fb1eff">1</span></p><div><span style="font-variant-ligatures: no-common-ligatures; color: #fb1eff"><br></span></div><div>--</div><div>Grüße,</div><div>Christoph</div>
<div><br><blockquote type="cite"><div>Am 12.12.2025 um 16:25 schrieb Daniel via Postfixbuch-users <postfixbuch-users@listen.jpberlin.de>:</div><br class="Apple-interchange-newline"><div><div>Moin,<br><br>Hardenize sagt ja Mailserver (i.d.R. postfix) ok, da wohl DNS und IP passt und auch deine Firewall, bleibt ja nur noch Webserver konfig.<br><br>Deine TLS Konfig im Mailserer könnte etwas strenger sein was als TLS 1.0 und 1.1 angeht, seiden möchtest bewusst lieber schlecht verschlüsselt als unverschlüsselt.<br><br>Beim Webserver passt Cert wohl nicht, da Domain wohl ohne www. nicht inkludiert ist.<br><br>Gruß Daniel<br><br>Von: Postfixbuch-users <postfixbuch-users-bounces@listen.jpberlin.de> Im Auftrag von Christoph Kukulies via Postfixbuch-users<br>Gesendet: Freitag, 12. Dezember 2025 14:57<br>An: Diskussionen und Support rund um Postfix <postfixbuch-users@listen.jpberlin.de><br><br>Betreff: Re: Ipv6 Verbindung<br><br>Nachtrag hinsichtlich iptables (ufw):<br><br>Last login: Fri Dec 12 10:05:24 2025 from XX.YYY.VVV.ZZZ <br>Status: active<br><br> To Action From<br> -- ------ ----<br>[ 1] 25 ALLOW IN Anywhere <br>[ 2] 443 ALLOW IN Anywhere <br>[ 3] 993 ALLOW IN Anywhere <br>[ 4] 587 ALLOW IN Anywhere <br>[ 5] 80 ALLOW IN Anywhere <br>[ 6] 22 ALLOW IN XX.YYY.VVV.ZZZ <br>[ 7] 443 (v6) ALLOW IN Anywhere (v6) <br>[ 8] 993 (v6) ALLOW IN Anywhere (v6) <br>[ 9] 587 (v6) ALLOW IN Anywhere (v6) <br>[10] 80 (v6) ALLOW IN Anywhere (v6) <br>[11] 25 (v6) ALLOW IN Anywhere (v6) <br><br><br><br><br><br>Am 12.12.2025 um 14:53 schrieb Christoph Kukulies <br><br>@Daniel: Ach so, dann war das wohl der Fehler. Hab ich nicht aufgepaßt.<br>Die SSLTools Site fand ich, macht immer Probleme. Die "Hardenize" Site sagt mir, ich<br>habe mit STARTTLS Probleme. (meine Domain s. Absender)<br><br><br><br><br>Danke für den Hinweis.<br><br>ifconfig -a<br><br>sagt mir, UP für inet und inet6, jeweils hinterlegt mit einer IPv$ bzw. IPV6 Adresse.<br><br>AAAA Record mit IPV6 Adresse hinterlegt im DNS<br><br><br>--<br>Grüße<br>Christoph<br><br><br><br><br>Am 12.12.2025 um 10:42 schrieb Andreas Pothe via Postfixbuch-users <mailto:postfixbuch-users@listen.jpberlin.de>:<br><br>Hi,<br><br>Am 12.12.2025 um 10:19 schrieb Christoph Kukulies via Postfixbuch-users:<br><br>Ich teste gerade meinen Mailserver im Internet mit ssllabs.com . Der ipv4 Test läuft einwandfrei, beim ipv6 Test,<br>allerdings, sagt mir das Tool "Assessment failed: Unable to connect to the server"<br>- Ist die IP6-Adresse auch "up"?<br><br>- Falls Du eine "Firewall" wie iptables einsetzt, ist der Zugriff freigegeben?<br><br>VG<br>Andreas<br><br><br></div></div></blockquote></div><br></div></body></html>