View source for King0770-Notes-smtp tls policy maps

{{Unsupported}}|{{ZCS 8.7}}|{{ZCS 9.0}}
{{WIP}}

<strong>The contents of this article are not yet complete and should be considered highly experimental.</strong> <br>
<strong>Changes to the zmconfigd.cf file will NOT survive upgrades.</strong><br>

By default, Zimbra has never modified smtp_tls_policy_maps, so adding smtp_tls_policy_maps would be considered a custom change. However, using the zimbra account, you could add the following to the /opt/zimbra/conf/zmconfigd.cf file; right above the <strong>RESTART mta</strong> line.
<code><pre>
POSTCONF smtp_tls_policy_maps        lmdb:/opt/zimbra/conf/tls_policy
</pre></code>

Then restart the MTA to pick up the changes. 
<code><pre>
zmmtactl restart
</pre></code>

Then check it as the zimbra user...
<code><pre>
postconf grep smtp_tls_policy_maps
smtp_tls_policy_maps = lmdb:/opt/zimbra/conf/tls_policy      <<== Should see this
</pre></code>

Make sure to run postmap against the /opt/zimbra/conf/tls_policy file; use <strong>"lmdb"</strong> not "hash"
<code><pre>
postmap /opt/zimbra/conf/tls_policy
</pre></code>

Make sure to double check the <strong>smtp_tls_security_level</strong> setting as well
<code><pre>
postconf | grep smtp_tls_security_level
</pre></code>
Possible smtp_tls_security_level options<br>
<strong>may</strong> TLS? good. no TLS? good.<br>
<strong>encrypt</strong> accept any invalid server certificate, demands encryption.<br>
<strong>verify</strong> accept trusted server certificate (do I trust the CA? does the CN match the MX?), demands encryption.<br>
<strong>secure</strong> only accept trusted certificate if CN/SAN matches the recipient domain - and ignore insecure (MX) information for validation.<br>

Notable RFE: https://bugzilla.zimbra.com/show_bug.cgi?id=108691 

Additional Info: http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps