# Using secure smtp to deliver/receive emails - using a different cert. with community edition **URL:** \ **Category:** General\ **Created:** [November 6, 2023, 9:04am UTC](https://community.ciphermail.com/t/using-secure-smtp-to-deliver-receive-emails-using-a-different-cert-with-community-edition/879 "2023-11-06T09:04:40Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![cs-fh](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@cs-fh](https://community.ciphermail.com/u/cs-fh)\ **Post date:** [November 6, 2023, 9:04am UTC](https://community.ciphermail.com/t/using-secure-smtp-to-deliver-receive-emails-using-a-different-cert-with-community-edition/879/1 "2023-11-06T09:04:40Z")
to secure e-mail transfer I would like to use ```auto smtp_tls_security_level = encrypt smtpd_tls_security_level = encrypt ``` sadly, this does not work error message is: ```auto status=deferred (TLS is required, but was not offered by host 127.0.0.1[127.0.0.1]) ``` I tried changing the certificate from the snakeoil to a letsencrypt one acquired via lego (go-acme/lego). I cannot upload it via the webinterface, and I am not allowed to change the option in the “MTA config file” so I chose to make a symlink for the two files: ```auto root@ciphermail:/home/user# ln -s /etc/lego/ciphermail.mydomain.com.crt /etc/ssl/certs/ssl-cert-snakeoil.pem root@ciphermail:/home/user# ln -s /etc/lego/ciphermail.mydomain.com.key /etc/ssl/private/ssl-cert-snakeoil.key ``` doing this it causes the webinterface to give the error: ```auto A problem occurred Error message:Render queue error in BeginRender[Login]: Error invoking service builder method mitm.djigzo.web.services.SoapModule.buildGlobalPreferencesManagerWS(GlobalPreferencesManagerWSProxyFactory, ApplicationStateManager) (at SoapModule.java:813) (for service 'GlobalPreferencesManagerWS'): org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service. Click here to continueContact your administrator if this condition persists ``` i have no idea where to go from here. Is there any further documentation on ssl certificates and how to change them manually? Thanks in advance. ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [November 6, 2023, 9:15am UTC](https://community.ciphermail.com/t/using-secure-smtp-to-deliver-receive-emails-using-a-different-cert-with-community-edition/879/2 "2023-11-06T09:15:12Z")
Checkout this post [SSL\_connect error to 127.0.0.1[127.0.0.1]:10025: -1 - #4 by martijn](https://community.ciphermail.com/t/ssl-connect-error-to-127-0-0-1-127-0-0-1-1/855/4) I think this is the same issue that you have, i.e., you changed the default which will then also require TLS when connecting to the back-end (which is not supported). You need to change the security level only for a specific service. In your case, do **not** add ```auto smtp_tls_wrappermode = yes ``` ---
**Author:** ![cs-fh](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@cs-fh](https://community.ciphermail.com/u/cs-fh)\ **Post date:** [November 6, 2023, 10:37am UTC](https://community.ciphermail.com/t/using-secure-smtp-to-deliver-receive-emails-using-a-different-cert-with-community-edition/879/3 "2023-11-06T10:37:03Z")
Thank you Martijn for you answer. I did not have that line in there. to test I added ```auto smtp_tls_wrappermode = no ``` no change in behavior. the error still persists. ```auto Nov 6 11:29:06 cipher mail postfix/smtp[2364]: 4SP6qy1tQ4zZcw0: to=, relay=127.0.0.1[127.0.0.1]:10025, delay=356, delays=356/0.01/0.04/0, dsn=4.7.4, status=deferred (TLS is required, but was not offered by host 127.0.0.1[127.0.0.1]) ``` ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [November 6, 2023, 10:39am UTC](https://community.ciphermail.com/t/using-secure-smtp-to-deliver-receive-emails-using-a-different-cert-with-community-edition/879/4 "2023-11-06T10:39:56Z")
Because you changed the global postfix setting for `smtp_tls_security_level` it means that it will be used for **all** smtp connections. What you should do it to only configure this for the smtp service used for outgoing email but **not** for the smtp connector which sends to the local back-end. in `/etc/postfix/master.cf`: ```auto smtp unix - - n - - smtp -o smtp_tls_security_level = encrypt ``` Make sure you remove the line `smtp_tls_security_level = encrypt` from the `main.cf` file. Now email sent via smtp to external should be forced to encrypt but email sent to the back-end (via the djigzo service) should not be TLS encrypted.