warning: /opt/postfix/conf/main.cf, line ...: overriding earlier entry, if Hardening Ciphers

Author: Becker884Created Jul 15, 2026Updated Sep 13, 2026

Labelsbugstale

Contribution guidelines

I've read the contribution guidelines and wholeheartedly agree

Checklist prior issue creation

I understand that failure to follow below instructions may cause this issue to be closed.
I understand that vague, incomplete or inaccurate information may cause this issue to be closed.
I understand that this form is intended solely for reporting software bugs and not for support-related inquiries.
I understand that all responses are voluntary and community-driven, and do not constitute commercial support.
I confirm that I have reviewed previous issues to ensure this matter has not already been addressed.
I confirm that my environment meets all prerequisite requirements as specified in the official documentation.

Description

I followed these instructions: https://docs.mailcow.email/manual-guides/Postfix/u_e-postfix-harden_ciphers/ for hardening ciphers.

tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
tls_preempt_cipherlist = yes

smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_ciphers = high
smtp_tls_mandatory_ciphers = high

smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_ciphers = high
smtpd_tls_mandatory_ciphers = high

when postfix starts the log says:

/opt/mailcow-dockerized/data/conf/postfix# docker exec $(docker ps -qf name=postfix-mailcow) postconf -h tls_high_cipherlist
/usr/sbin/postconf: warning: /opt/postfix/conf/main.cf, line 207: overriding earlier entry: smtp_tls_protocols=>=TLSv1.2
/usr/sbin/postconf: warning: /opt/postfix/conf/main.cf, line 211: overriding earlier entry: smtpd_tls_protocols=>=TLSv1.2
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

Solution: Remove duplicate entries in extra.cf to:

myhostname = mail.myname.de

tls_config_file = /opt/postfix/conf/openssl.cnf
tls_config_name = postfix

tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

smtp_tls_ciphers = high
smtp_tls_mandatory_ciphers = high
smtpd_tls_ciphers = high

Please note: this part

tls_config_file = /opt/postfix/conf/openssl.cnf
tls_config_name = postfix

belongs to Update the Mailcow encryption suite#7208

Steps to reproduce:

docker logs $(docker ps -qf name=postfix-mailcow) 2>&1 | grep -i "extra\|error\|warning" | head -30 or docker exec $(docker ps -qf name=postfix-mailcow) postconf -h tls_high_cipherlist

Logs:

plain

/usr/sbin/postconf: warning: /opt/postfix/conf/main.cf, line 207: overriding earlier entry: smtp_tls_protocols=>=TLSv1.2
/usr/sbin/postconf: warning: /opt/postfix/conf/main.cf, line 211: overriding earlier entry: smtpd_tls_protocols=>=TLSv1.2

Which branch are you using?

master (stable)

Which architecture are you using?

x86_64

Operating System:

Ubuntu 24.04 LTS

Server/VM specifications:

8GB, 4 Cores

Is Apparmor, SELinux or similar active?

Virtualization technology:

KVM

Docker version:

29.6.1

docker-compose version or docker compose version:

29.6.1

mailcow version:

2026-07

Reverse proxy:

nginx

Logs of git diff:

plain

extraneous

Logs of iptables -L -vn:

plain

extraneous

Logs of ip6tables -L -vn:

plain

extraneous

Logs of iptables -L -vn -t nat:

plain

extraneous

Logs of ip6tables -L -vn -t nat:

plain

extraneous

DNS check:

plain

extraneous

Source: mailcow/mailcow-dockerized

View original on GitHub View discussion on GitHub