freedomofpress/securedrop — pull request #812 by dolanjs (2014-12-17 03:22:55+00:00)
Title: removed ca_cert var

Taken from a conversation with @ageis

We currently enforce checking the smtp relay's fingerprint in the postfix config in:

`securedrop/install_files/ansible-base/roles/ossec_server/templates/main.cf`

`smtp_tls_security_level = fingerprint`

One of the other postfix options is to "verify" where it checks the certs ca trust chain. If verify is set the smtp_tls_CAfile option is required.

Since we set the smtp_tls_Security_level to fingerprint the chain of trust is not checked. If smtp_cafile option is specified in the config file then a file does need to be provided but it is not used verifying the connection providing no value while adding extra steps.

Didn't see any other references to the `ca_cert` variable.