how do I get STARTTLS working with sendmail on FreeBSD 10.3 ?

William Dudley wfdudley at
Sun Mar 19 20:04:47 UTC 2017

I have all of the stuff you referenced in my ${hostname}.mc.

I have a dh.param in /etc/mail/certs

And yet,

telnet localhost 25
Connected to localhost.
Escape character is '^]'.
220 ESMTP Sendmail 8.15.2/8.15.2; Sun, 19 Mar 2017 16:02:48
-0400 (EDT)
ehlo localhost Hello localhost [], pleased to meet you
250 HELP
221 2.0.0 closing connection
Connection closed by foreign host.

in which STARTTLS is conspicuous by it's absence.

Surely I am missing some crucial, undocumented step.

Is there anything else I should check?

Bill Dudley

This email is free of malware because I run Linux.

On Sun, Mar 19, 2017 at 10:34 AM, Matthew Seaman <matthew at>

> On 18/03/2017 22:44, William Dudley wrote:
> > A google search does not reveal a useful answer.
> >
> > I just want to use a self-signed certificate so I can get my email from
> my
> > FreeBSD mail server to my cell phone.  My FreeBSD server runs sendmail.
> > I don't really want to switch to postfix, qmail, etc. etc.
> Hmm... STARTTLS capability is enabled by default in in 11.0
> -- I think it might be on 10.3 as well.
> Anyhow, you need the following sort of thing in your ${hostname}.mc --
> define(`CERT_DIR', `/etc/mail/certs')dnl
> define(`confSERVER_CERT', `CERT_DIR/host.cert')dnl
> define(`confSERVER_KEY', `CERT_DIR/host.key')dnl
> define(`confCLIENT_CERT', `CERT_DIR/host.cert')dnl
> define(`confCLIENT_KEY', `CERT_DIR/host.key')dnl
> define(`confCACERT', `CERT_DIR/cacert.pem')dnl
> define(`confCACERT_PATH', `CERT_DIR')dnl
> define(`confDH_PARAMETERS', `CERT_DIR/dh.param')dnl
> and you need to create all of the host.key and host.cert and cacert.pem
> and dh.param files.  That's mostly covered here:
> Note that for e-mail purposes you don't generally need a certificate
> signed by a well known CA -- just self signed is fine.  With e-mail,
> it's more important to ensure privacy in transit rather than to identify
> the party you're corresponding with.
> The dh.param file you can generate by:
>   openssl dHParam -outform PEM -out dh.param 2048
> IIRC adding all this will allow your sendmail install to support
> STARTTLS, but not make it require STARTTLS.  I believe there's a
> DAEMON_OPTIONS setting to achieve that, but I'd need to look that up.
> Get hold of the O'Reilly sendmail book if you're interested -- it has
> details of all this stuff.
>         Cheers,
>         Matthew

More information about the freebsd-questions mailing list