tls.cert.self_signed
Self-Signed Certificate
What we check
We validate the presented certificate chain against a pinned bundle of trusted root CAs. A certificate is flagged as self-signed when its issuer and subject are the same entity and no trusted CA vouches for it.
What this finding means
The server presents a certificate it signed itself — no certificate authority has verified the server operator's identity. Any party can generate a self-signed certificate for any hostname, so it provides encryption but no authentication.
Why it matters
- No identity verification. Sending servers have no way to confirm they are talking to the legitimate mail server and not an interceptor. TLS without authentication is vulnerable to active man-in-the-middle attacks.
- Policy failures. Senders enforcing MTA-STS or DANE will refuse delivery to a self-signed certificate. Even without strict policies, some senders log or flag self-signed certificates.
- Free alternatives exist. Let's Encrypt and other ACME CAs issue domain-validated certificates at no cost, so there is no practical reason for a production mail server to use a self-signed certificate.
How to fix
Install a CA-signed certificate. The simplest path is Let's Encrypt with certbot:
# Install certbot (Debian/Ubuntu) apt install certbot # Obtain a certificate (standalone HTTP challenge) certbot certonly --standalone -d mail.example.com # Or use DNS challenge if port 80 is not available certbot certonly --manual --preferred-challenges dns -d mail.example.comConfigure the mail server to use the new certificate. For Postfix:
# /etc/postfix/main.cf smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pemReload and verify:
systemctl reload postfix openssl s_client -starttls smtp -connect mail.example.com:25 \ -servername mail.example.com 2>/dev/null | openssl x509 -noout -issuerThe issuer should now show a recognized CA, not the server itself.
Set up automatic renewal — certbot's systemd timer handles this by default, but confirm it is active.
How it's graded
A self-signed certificate carries a –20 penalty in the TLS category. See Grading Methodology for the full scoring model.
Evidence example
$ openssl s_client -starttls smtp -connect mail.example.com:25 \
-servername mail.example.com 2>/dev/null | openssl x509 -noout -subject -issuer
subject=CN = mail.example.com
issuer=CN = mail.example.com ← issuer == subject: self-signed