TLS Handshake Failed
Check certificate chain, protocol compatibility, SNI, permissions and policy maps.
Production note: Back up configuration, run
postfix check, and stage changes before reloading.Recognize the symptom
Check certificate chain, protocol compatibility, SNI, permissions and policy maps.
Capture timestamps, queue IDs, client/server addresses, and complete log lines before changing configuration.
Immediate triage
postfix status
postfix check
postqueue -p
journalctl -u postfix --since "30 minutes ago"Investigation path
- Confirm scope and first occurrence.
- Identify the relevant Postfix service.
- Query effective configuration with
postconf. - Reproduce with a controlled test.
- Compare against the last known-good state.
Recovery and verification
Make the smallest reversible correction, reload Postfix, repeat the controlled test, and monitor queue age and error rates.
Prevention
Add monitoring, configuration version control, documented ownership, and a tested rollback procedure.