If you modified main.cf then you have to put the equivalent commands there. and of course run posthash on those two hash dictionary files above after each change or add them to the list to be automatically rehashed.
You still have to do the SASL password bit. These instructions only make postfix look at the sender address and decide which relayhost to use for which emails. I only had to put my gmail passwords in /etc/postfix/sasl_passwd and it became enabled.
Thanks for the reply. I added the two lines to /etc/sysconfig/postfix, created /etc/postfix/sender_dependent_relayhost and /etc/postfix/tls_per_site
and hashed them, but I still get the following errors:
04121A380 885 Fri Nov 6 11:26:24 wwwrun@linux-sgt9.site
(delivery temporarily suspended: TLS is required, but our TLS engine is unavailable) user@gmail.com
Am I not perhaps missing a package or something? I thought it might have been openssl, but I do have the latest version.
I don’t know. The settings I added are the only additions to a stock sysconfig/postfix, or alternatively, main.cf. Perhaps you are trying to enable TLS in a server capacity. When you are using postfix as a client to relay to gmail using TLS, you don’t need to support server TLS. The settings starting with smtpd_ are to do with postfix as server, those starting with smtp_ are to do with postfix as a client.
Ok, I discovered that I was by accident not enforcing TLS on gmail connections. Mail did go through however. However to fix it and make TLS enforced, all that’s needed is to add this directive to main.cf:
smtp_tls_CApath = /etc/ssl/certs
You then have to run
c_rehash /etc/ssl/certs
to make sure that the certs are hashed, then reload postfix. Then when smtp.gmail.com presents its cert, it will be checked against the Thawte cert in that directory. Using CApath instead of CAfile makes all the certs in /etc/ssl/certs valid, and you don’t have to choose one to put in cacert.pem and point CAfile to it as suggested by most tutes, which will fail if gmail switches to another CA.
As mentioned before, you only need to enable TLS on smtp, not smtpd if you only want to relay to gmail, and not be a secure mail server for road warriors. So all those steps about creating a self-signed cert in tutes are not required in this situation.
Having just installed 11.2 and configured postfix and got it working with gmail, I figured out what you are missing. Because you edited main.cf and master.cf yourself, the settings in /etc/sysconfig/postfix do not affect the configuration. In particular you haven’t started the tlsmgr process normally commented out in master.cf. If you had stuck to making mods only on /etc/sysconfig/postfix and using YaST to generate main.cf and master.cf, tlsmgr would be one of the processes started.