117-303 · Question #98
Which of the following parameters should be set in main.cf to enable TLS in Postfix?
The correct answer is A. smtpd_tls_cert_file, smtpd_tls_key_file, smtpd_tls_CAfile, smtpd_use_tls. See the full explanation below for the reasoning.
Question
Options
- Asmtpd_tls_cert_file, smtpd_tls_key_file, smtpd_tls_CAfile, smtpd_use_tls
- Bsmtpd_tls_key_file, smtpd_tls_CAfile, smtpd_use_tls, smtpd_tls_pem_file
- Csmtpd_tls_CAfile, smtpd_use_tls, smtpd_tls_pem_file, smtpd_tls_cert_file
- Dsmtpd_use_tls, smtpd_tls_pem_file, smtpd_tls_cert_file, smtpd_tls_key_file
How the community answered
(24 responses)- A79% (19)
- B4% (1)
- C4% (1)
- D13% (3)
Community Discussion
4
Luis F.Nov 26, 2025Answer is A and here is why: Postfix TLS requires smtpd_tls_cert_file for the server certificate, smtpd_tls_key_file for the private key, smtpd_tls_CAfile for the CA chain, and smtpd_use_tls to actually turn TLS on, which is the exact set in option A. The other options swap in smtpd_tls_pem_file which is not a real Postfix parameter, so those are traps.
Samuel O.Nov 21, 2025Spent years managing mail servers before pivoting to certs, and the key thing to internalize here is that Postfix needs three separate files to do TLS right, not a combined PEM, so any option that substitutes smtpd_tls_pem_file for one of the real parameters is a trap. Can anyone walk through why the CAfile specifically matters in that parameter set, and what breaks at the handshake level if you leave it out?
Luis F.Nov 22, 2025Samuel you are right that skipping smtpd_tls_CAfile does not break outbound TLS but it kills client certificate verification, so if you ever add mutual TLS later or your MTA needs to validate a peer cert chain, the handshake fails with an untrusted issuer error right at the STARTTLS exchange.
Mei-Ling H.Nov 14, 2025I picked D at first because it starts with smtpd_use_tls and felt like a complete set, but then I looked more carefully at the parameter names and realized D includes smtpd_tls_pem_file, which is not a real Postfix parameter at all. Same trap in B and C, they all sneak that fake smtpd_tls_pem_file in there. Once I crossed out any option containing that made-up parameter, only A was left, and it has the four you actually set in main.cf, smtpd_tls_cert_file for your certificate, smtpd_tls_key_file for the private key, smtpd_tls_CAfile for the CA chain, and smtpd_use_tls to turn it on. The question is really testing whether you know the real parameter names, so watch that "pem_file" decoy, it is the whole trick here.