Cannot create SSL Certificate for Virtualmin dashboard

[shoulders]

@Ilia

Even though it’s off by default, the reject_unknown_client_hostname option in Postfix checks if the connecting IP has a PTR record and if that hostname points back to the same IP (FCrDNS). If either check fails, Postfix rejects the request. Yes, it’s not required by RFCs, but many admins turn it on manually. Spam filters also often use FCrDNS as a trust signal, though it usually only has a small impact on the overall spam score.

I use this.

Also when ECH (encrypted client hello) becomes a thing, the hostname might need a cert.

[Joe]

@Ilia

Even though it’s off by default, the reject_unknown_client_hostname option in Postfix checks if the connecting IP has a PTR record and if that hostname points back to the same IP (FCrDNS). If either check fails, Postfix rejects the request.

That is not what I’m saying doesn’t matter. You’ve just confirmed what I said elsewhere. The PTR does not have to match the system hostname, even if Postfix has that option enabled. If that option is enabled, the sender must have a PTR record and it must resolve back to the IP, which is not the same as “must match the system hostname” (in /etc/hosts, /etc/hostname, whatever).