title: Postfix: Setup corret certificate chain
body: <p>I can't for the life of me figure out what I'm doing wrong here.
  I can't get TLS to work properly on my Postfix-server.</p>
  <p>I have a wildcard certificate from Thawte and I have put the wildcard and intermediate certificate in the same file. This is my main.cf:</p>
  <pre><code>smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
  inet_interfaces = all
  inet_protocols = ipv4
  mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.165.199.0/24
  alias_maps = hash:/etc/aliases
  alias_database = hash:/etc/aliases
  myorigin = /etc/mailname
  biff = no
  
  smtpd_use_tls=yes
  smtpd_tls_security_level = may
  smtpd_tls_key_file = /etc/postfix/cert/device.key
  smtpd_tls_cert_file = /etc/postfix/cert/device.crt
  smtpd_tls_CAfile = /etc/postfix/cert/rootCA.pem
  smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  smtp_use_tls = yes
  smtp_tls_security_level = may
  smtp_tls_loglevel = 1
  smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  
  smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,defer_unauth_destination
  smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
  smtpd_sasl_local_domain = $myhostname
  smtpd_sasl_auth_enable = yes
  smtpd_sasl_security_options = noanonymous
  broken_sasl_auth_clients = yes
  </code></pre>
  <p>and this is my certificate file (I didn't paste the entire certificate).</p>
  <pre><code>-----BEGIN CERTIFICATE-----
  MIIGsDCCBZigAwIBAgIQSgo15k4YWfFlAngSiZuLETANBgkqhkiG9w0BAQsFADBD
  MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMR0wGwYDVQQDExR0
  ...........Wildcard certificate............
  gjgbXl6MjrVSj6FfDNJFjemtNRyHVEG+pOIE3s2bdxbW0GyKUu4Xv1lhs81AbriG
  cCtxINchiAgsWURmK1oq8ebScFpgv30UWEpdkyToAjSbl1wq
  -----END CERTIFICATE-----
  -----BEGIN CERTIFICATE-----
  MIIE3DCCA8SgAwIBAgIQPiM0Wu0sClF7Jt7UgB0QqjANBgkqhkiG9w0BAQsFADCB
  rjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf
  ......Intermediate certificate........
  Hi36v6dJog2X9ZbC6WzUzUcLi4oBi9v6z5J1Lt4+p3O1/gNRp0LDx0JrqW++9iDh
  jr+fCY7lCOiSk3c+SUScf+l5nf9Lr+A4VzQNXxEyEpKpYYiBpR74oPBFWoZxIIWF
  -----END CERTIFICATE-----
  </code></pre>
  <p>When I run <code>openssl s_client -connect smtp-out.domain.com:587 -starttls smtp</code></p>
  <p>I get messages like these:</p>
  <blockquote>
  <p>unable to get local issuer certificate</p>
  <p>unable to verify the first certificate</p>
  <p>certificate not trusted</p>
  </blockquote>
  <pre><code>Certificate chain
  0 s:/C=SE/ST=State/L=City/O=Company/OU=INC/CN=*.domain.com
     i:/C=US/O=thawte, Inc./CN=thawte SHA256 SSL CA
   1 s:/C=US/O=thawte, Inc./OU=Domain Validated SSL/CN=thawte DV SSL SHA256 CA
     i:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3
  </code></pre>
  <p>What do I have to do to get this working properly?
  Obviously I'm missing something but I can't figure out what.</p>
  <p>Also I get this in the log:</p>
  <pre><code>warning: TLS library problem: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1315:SSL alert number 48:
  </code></pre>