al3x/sovereign — pull request #26 by lukecyca (2013-09-17 10:17:11+00:00)
Title: Postfix TLS fixes

I noticed that SSL on smptd wasn't providing a verifiable cert:

```
luke@mbp:~ ><((°> openssl s_client -connect mail.al3x.net:465
...
Verify return code: 21 (unable to verify the first certificate)
```

This can be fixed by providing the cert chain including the intermediate CA cert. Now it verifies:

```
luke@mbp:~ [130] ><((ˣ> openssl s_client -connect mail.lukecyca.com:465
...
Verify return code: 0 (ok)
```

I also noticed that Postfix was establishing "untrusted" connections to other mail servers when sending, like this:
```
Sep 16 10:30:20 vps1 postfix/smtp[11276]: Untrusted TLS connection established to gmail-smtp-in.l.google.com
```

which is fixed by telling postfix about the ca-certificates that are installed. Not they're trusted:

```
Sep 16 12:24:04 vps1 postfix/smtp[13168]: Trusted TLS connection established to gmail-smtp-in.l.google.com
```

----
ps: Thanks for creating sovereign! I'm pumped to implement it for myself and contribute improvements back. I've got a bunch of commits queued up which I'll submit as individual pull requests so you can pick and choose.