{"id":165,"date":"2026-10-18T09:01:08","date_gmt":"2026-10-18T06:01:08","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/smtp-tls-sertifikasi-starttls-chain-sni-certificate-mismatch\/"},"modified":"2026-10-18T09:01:08","modified_gmt":"2026-10-18T06:01:08","slug":"smtp-tls-sertifikasi-starttls-chain-sni-certificate-mismatch","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/tr\/smtp-tls-sertifikasi-starttls-chain-sni-certificate-mismatch\/","title":{"rendered":"SMTP TLS Sertifikas\u0131 Rehberi: STARTTLS, Zincir (Chain), SNI ve \u201cCertificate Mismatch\u201d Hatalar\u0131n\u0131 \u00c7\u00f6zme"},"content":{"rendered":"<h2>SMTP\u2019de TLS (STARTTLS) neden \u00f6nemlidir?<\/h2>\n<p>Kurumsal e-posta trafi\u011fi, \u00e7o\u011fu zaman birden fazla sunucu aras\u0131nda aktar\u0131l\u0131r: g\u00f6nderen MTA\u2019dan (mail transfer agent) al\u0131c\u0131 MTA\u2019ya, bazen de aradaki gateway\u2019ler \u00fczerinden. Bu aktar\u0131m s\u0131ras\u0131nda ba\u011flant\u0131n\u0131n \u015fifrelenmesi, mesaj i\u00e7eri\u011finin a\u011f \u00fczerinde d\u00fcz metin olarak ta\u015f\u0131nmas\u0131n\u0131 \u00f6nlemek i\u00e7in kritik bir g\u00fcvenlik katman\u0131d\u0131r. SMTP d\u00fcnyas\u0131nda bu \u015fifreleme \u00e7o\u011funlukla STARTTLS ile sa\u011flan\u0131r. STARTTLS, ba\u011flant\u0131y\u0131 d\u00fcz SMTP ile ba\u015flat\u0131p ard\u0131ndan TLS\u2019e y\u00fckseltir.<\/p>\n<p>Ancak TLS\u2019in var olmas\u0131 tek ba\u015f\u0131na yeterli de\u011fildir. Sertifikan\u0131n do\u011fru host ad\u0131yla e\u015fle\u015fmesi, tam sertifika zincirinin (certificate chain) sunulmas\u0131, eski protokollerin kapat\u0131lmas\u0131 ve baz\u0131 durumlarda SNI (Server Name Indication) gibi mekanizmalar\u0131n do\u011fru \u00e7al\u0131\u015fmas\u0131 gerekir. Aksi halde baz\u0131 al\u0131c\u0131 sunucular TLS\u2019i reddeder, baz\u0131lar\u0131 \u015fifrelemeyi atlar ve baz\u0131 ortamlarda teslimat gecikmeleri veya \u201cdeferred\u201d gibi kuyruklanma sorunlar\u0131 g\u00f6r\u00fclebilir.<\/p>\n<h2>SMTP TLS nas\u0131l \u00e7al\u0131\u015f\u0131r: SMTPS de\u011fil, STARTTLS<\/h2>\n<p>Pratikte iki kavram kar\u0131\u015ft\u0131r\u0131l\u0131r: \u201cSMTPS\u201d ve \u201cSMTP + STARTTLS\u201d. G\u00fcn\u00fcm\u00fczde sunucudan sunucuya e-posta aktar\u0131m\u0131nda yayg\u0131n olan model, TCP\/25 \u00fczerinden SMTP konu\u015fup STARTTLS ile \u015fifrelemeye ge\u00e7mektir. \u0130stemciden (kullan\u0131c\u0131 uygulamas\u0131) sunucuya g\u00f6nderimde ise genellikle TCP\/587 (SMTP Submission) ve TLS kullan\u0131l\u0131r; baz\u0131 senaryolarda TCP\/465 (implicit TLS) de g\u00f6r\u00fclebilir.<\/p>\n<p>Bu ayr\u0131m te\u015fhis i\u00e7in \u00f6nemlidir \u00e7\u00fcnk\u00fc ayn\u0131 sertifika farkl\u0131 portlarda farkl\u0131 davran\u0131\u015flara yol a\u00e7abilir. \u00d6rne\u011fin 25\u2019te sunulan sertifika ile 587\u2019de sunulan sertifika ayn\u0131 olabilir, ama ayr\u0131 servisler veya farkl\u0131 sanal host tan\u0131mlar\u0131 nedeniyle farkl\u0131 sertifika zinciri g\u00f6nderiliyor olabilir.<\/p>\n<h2>Sertifika do\u011frulamas\u0131nda al\u0131c\u0131 sunucular neye bakar?<\/h2>\n<h3>1) Hostname e\u015fle\u015fmesi (CN\/SAN)<\/h3>\n<p>Al\u0131c\u0131 sistem, TLS oturumu kurulurken sertifikan\u0131n konu ad\u0131n\u0131n (Common Name) veya daha do\u011frusu SAN (Subject Alternative Name) alanlar\u0131n\u0131n, ba\u011fland\u0131\u011f\u0131 host ad\u0131yla uyumlu olmas\u0131n\u0131 bekler. SMTP\u2019de bu \u201changi isme ba\u011flan\u0131yorum?\u201d sorusu \u00e7o\u011fu zaman MX kayd\u0131ndaki hedef \u00fczerinden \u015fekillenir. Yani al\u0131c\u0131, MX kayd\u0131n\u0131zda yazan host ad\u0131na ba\u011flan\u0131r ve TLS sertifikan\u0131z\u0131n o host ad\u0131n\u0131 kapsamas\u0131n\u0131 bekler.<\/p>\n<p>Yayg\u0131n hata: MX kayd\u0131n\u0131z mail.example.com g\u00f6sterirken sertifikan\u0131z yaln\u0131zca example.com veya web.example.com i\u00e7in al\u0131nm\u0131\u015ft\u0131r. Bu durumda baz\u0131 al\u0131c\u0131lar \u201ccertificate mismatch\u201d veya \u201chostname verification failed\u201d benzeri hatalar \u00fcretebilir.<\/p>\n<h3>2) Sertifika zinciri (Intermediate CA) eksik mi?<\/h3>\n<p>Sunucunuz yaln\u0131zca leaf (sunucu) sertifikas\u0131n\u0131 g\u00f6nderiyor, ama ara sertifikalar\u0131 (intermediate) g\u00f6ndermiyorsa baz\u0131 al\u0131c\u0131lar zinciri tamamlayamaz. Baz\u0131 sistemlerde istemci taraf\u0131nda ara sertifika \u00f6nbelle\u011fi oldu\u011fundan sorun \u201cbaz\u0131 al\u0131c\u0131larda var, baz\u0131lar\u0131nda yok\u201d \u015feklinde kendini g\u00f6sterebilir. Bu da te\u015fhisi zorla\u015ft\u0131r\u0131r.<\/p>\n<p>Do\u011fru yakla\u015f\u0131m, sunucunun \u201cfull chain\u201d (leaf + intermediate) sunacak \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131d\u0131r. Root sertifika genellikle g\u00f6nderilmez; al\u0131c\u0131lar root\u2019u zaten g\u00fcven deposunda tutar.<\/p>\n<h3>3) Ge\u00e7erlilik, zaman ve algoritmalar<\/h3>\n<p>Sertifikan\u0131n s\u00fcresi dolmu\u015fsa, hen\u00fcz ge\u00e7erli de\u011filse (saat fark\u0131), \u00e7ok zay\u0131f anahtar kullan\u0131yorsa veya art\u0131k kabul g\u00f6rmeyen algoritmalar i\u00e7eriyorsa TLS el s\u0131k\u0131\u015fmas\u0131 (handshake) ba\u015far\u0131s\u0131z olabilir. Bu t\u00fcr sorunlar, e-postan\u0131n tamamen durmas\u0131na yol a\u00e7masa bile baz\u0131 al\u0131c\u0131lar\u0131n TLS\u2019i zorunlu kabul etti\u011fi ortamlarda teslimat\u0131 engelleyebilir.<\/p>\n<h2>SNI nedir ve SMTP\u2019de neden kar\u015f\u0131n\u0131za \u00e7\u0131kar?<\/h2>\n<p>SNI (Server Name Indication), bir IP \u00fczerinde birden fazla TLS sertifikas\u0131 bar\u0131nd\u0131ran sunucularda, istemcinin \u201changi alan ad\u0131 i\u00e7in ba\u011fland\u0131\u011f\u0131n\u0131\u201d TLS el s\u0131k\u0131\u015fmas\u0131n\u0131n ba\u015f\u0131nda s\u00f6ylemesini sa\u011flar. Web\u2019de \u00e7ok yayg\u0131nd\u0131r; SMTP\u2019de de giderek daha s\u0131k g\u00f6r\u00fcl\u00fcr.<\/p>\n<p>SNI\u2019nin kritik oldu\u011fu senaryolar:<\/p>\n<ul>\n<li>Bir IP \u00fczerinde birden fazla mail domaini veya birden fazla TLS sertifikas\u0131 bar\u0131nd\u0131r\u0131yorsan\u0131z<\/li>\n<li>Reverse proxy veya mail gateway arkas\u0131nda sanal host mant\u0131\u011f\u0131yla TLS sonland\u0131r\u0131yorsan\u0131z<\/li>\n<li>Ayn\u0131 sunucuda hem web hem mail servisleri var ve yap\u0131land\u0131rmalar kar\u0131\u015fm\u0131\u015fsa<\/li>\n<\/ul>\n<p>SNI d\u00fczg\u00fcn \u00e7al\u0131\u015fmad\u0131\u011f\u0131nda sunucu, istemciye \u201cvarsay\u0131lan\u201d sertifikay\u0131 sunabilir. Bu sertifika yanl\u0131\u015f alan ad\u0131n\u0131 kaps\u0131yorsa, al\u0131c\u0131 taraf \u201cmismatch\u201d g\u00f6r\u00fcr. Baz\u0131 al\u0131c\u0131lar bu durumda TLS\u2019i b\u0131rak\u0131p d\u00fcz SMTP ile devam edebilir, baz\u0131lar\u0131 ise politikalar\u0131 gere\u011fi ba\u011flant\u0131y\u0131 kesebilir.<\/p>\n<h2>En s\u0131k g\u00f6r\u00fclen SMTP TLS sertifika hatalar\u0131 ve anlamlar\u0131<\/h2>\n<h3>\u201cCertificate mismatch\u201d \/ \u201cHostname verification failed\u201d<\/h3>\n<p>Genellikle sertifika, al\u0131c\u0131n\u0131n ba\u011fland\u0131\u011f\u0131 MX host ad\u0131n\u0131 SAN i\u00e7inde i\u00e7ermiyordur. \u00c7\u00f6z\u00fcm \u00e7o\u011fu zaman, MX\u2019in i\u015faret etti\u011fi FQDN i\u00e7in uygun sertifika almak veya MX hedefini sertifikan\u0131n kapsad\u0131\u011f\u0131 host ad\u0131na ta\u015f\u0131makt\u0131r.<\/p>\n<h3>\u201cUnable to get local issuer certificate\u201d \/ \u201cUnknown CA\u201d<\/h3>\n<p>\u00c7o\u011fu zaman intermediate zinciri eksiktir veya yanl\u0131\u015f s\u0131rada sunuluyordur. Sunucu sertifikas\u0131n\u0131 \u201cfull chain\u201d dosyas\u0131yla sunmak ve do\u011fru chain\u2019i y\u00fcklemek gerekir.<\/p>\n<h3>\u201cHandshake failure\u201d \/ \u201cNo shared cipher\u201d<\/h3>\n<p>Taraflar ortak \u015fifre tak\u0131m\u0131 (cipher) veya TLS s\u00fcr\u00fcm\u00fc \u00fczerinde anla\u015fam\u0131yordur. Eski TLS s\u00fcr\u00fcmlerini kapatmak do\u011fru bir g\u00fcvenlik yakla\u015f\u0131m\u0131d\u0131r, ancak \u00e7ok kat\u0131 ayarlar baz\u0131 eski sistemlerle uyumsuzluk yaratabilir. Burada ama\u00e7, makul bir g\u00fcvenlik seviyesiyle geni\u015f uyumlulu\u011fu dengelemektir.<\/p>\n<h3>\u201cCertificate expired\u201d<\/h3>\n<p>Sertifika s\u00fcresi dolmu\u015ftur. Mail sunucular\u0131nda bu hata bazen g\u00f6zden ka\u00e7ar \u00e7\u00fcnk\u00fc web taray\u0131c\u0131s\u0131 gibi \u201can\u0131nda g\u00f6r\u00fcn\u00fcr\u201d bir i\u015faret yoktur. Takvim hat\u0131rlatmalar\u0131, izleme ve d\u00fczenli kontrol kritik \u00f6nemdedir.<\/p>\n<h2>Te\u015fhis yakla\u015f\u0131m\u0131: ad\u0131m ad\u0131m kontrol listesi<\/h2>\n<h3>1) MX hedefini ve ger\u00e7ek ba\u011flan\u0131lan host ad\u0131n\u0131 netle\u015ftirin<\/h3>\n<p>\u00d6nce domaininizin MX kay\u0131tlar\u0131n\u0131n hangi FQDN\u2019e i\u015faret etti\u011fini belirleyin. Ard\u0131ndan al\u0131c\u0131lar\u0131n ba\u011flanaca\u011f\u0131 host ad\u0131 budur varsay\u0131m\u0131yla sertifikan\u0131z\u0131n SAN alanlar\u0131n\u0131 kontrol edin. E\u011fer bir load balancer veya gateway kullan\u0131yorsan\u0131z, TLS\u2019in nerede sonland\u0131\u011f\u0131n\u0131 da netle\u015ftirin.<\/p>\n<h3>2) Sertifika zincirinin tam sunuldu\u011funu do\u011frulay\u0131n<\/h3>\n<p>Sunucunuzun leaf sertifikayla birlikte intermediate sertifikalar\u0131 g\u00f6nderdi\u011fini do\u011frulay\u0131n. \u201cBaz\u0131 al\u0131c\u0131lar sorun ya\u015f\u0131yor\u201d durumlar\u0131n\u0131n \u00f6nemli bir k\u0131sm\u0131 chain kaynakl\u0131d\u0131r.<\/p>\n<h3>3) Ayn\u0131 IP\u2019de birden fazla sertifika varsa SNI davran\u0131\u015f\u0131n\u0131 test edin<\/h3>\n<p>SNI olmayan istemciler hangi sertifikay\u0131 g\u00f6r\u00fcyor, SNI olanlar hangi sertifikay\u0131 g\u00f6r\u00fcyor sorusunu yan\u0131tlay\u0131n. Yanl\u0131\u015f \u201cdefault certificate\u201d sunulmas\u0131, \u00f6zellikle \u00e7oklu domain bar\u0131nd\u0131ran yap\u0131larda yayg\u0131nd\u0131r.<\/p>\n<h3>4) Ge\u00e7erlilik s\u00fcresi, anahtar uzunlu\u011fu ve imza algoritmas\u0131n\u0131 kontrol edin<\/h3>\n<p>Sertifikan\u0131n s\u00fcresi, RSA\/ECDSA anahtar parametreleri ve kullan\u0131lan imza algoritmas\u0131 modern al\u0131c\u0131larla uyumlu olmal\u0131d\u0131r. Ayr\u0131ca sunucu saati ve zaman senkronizasyonu do\u011fru olmal\u0131d\u0131r.<\/p>\n<h2>D\u00fczeltme stratejileri: kal\u0131c\u0131 \u00e7\u00f6z\u00fcm i\u00e7in \u00f6neriler<\/h2>\n<h3>MX ve sertifika ad\u0131n\u0131 uyumlu tasarlay\u0131n<\/h3>\n<p>En pratik tasar\u0131m, MX hedefini mail.example.com gibi net bir isimde sabitlemek ve sertifikay\u0131 bu isim i\u00e7in almak\/yenilemektir. E\u011fer birden fazla isim kullanman\u0131z gerekiyorsa (\u00f6r. mail.example.com ve mx.example.com), sertifikaya SAN olarak ekleyin.<\/p>\n<h3>Full chain kullan\u0131n ve yap\u0131land\u0131rmay\u0131 standartla\u015ft\u0131r\u0131n<\/h3>\n<p>Bir\u00e7ok mail servisi sertifika dosyalar\u0131n\u0131 ayr\u0131 ayr\u0131 ister: private key, leaf cert ve chain. Yanl\u0131\u015f dosyay\u0131 yanl\u0131\u015f alana koymak s\u0131k yap\u0131lan hatad\u0131r. Yap\u0131land\u0131rmay\u0131 belgelendirin, de\u011fi\u015fiklikleri kontroll\u00fc uygulay\u0131n.<\/p>\n<h3>Sertifika yenilemelerini operasyonel bir s\u00fcrece ba\u011flay\u0131n<\/h3>\n<p>\u201cSertifika s\u00fcresi doldu\u201d problemleri teknik de\u011fil operasyonel bir eksikliktir. Sorumluluk atay\u0131n, yenileme takvimi belirleyin, de\u011fi\u015fiklikten sonra d\u0131\u015far\u0131dan do\u011frulama yap\u0131n. Sertifika yenilemesi sadece dosyay\u0131 g\u00fcncellemek de\u011fil, servislerin yeniden y\u00fcklenmesi ve do\u011fru sertifikan\u0131n sunuldu\u011funun test edilmesi anlam\u0131na gelir.<\/p>\n<h2>Teslimat ve g\u00fcvenlik a\u00e7\u0131s\u0131ndan beklentiyi do\u011fru y\u00f6netin<\/h2>\n<p>STARTTLS bir\u00e7ok ortamda \u201copportunistic\u201d \u00e7al\u0131\u015f\u0131r: iki taraf destekliyorsa \u015fifreli olur, desteklemiyorsa d\u00fcz devam edebilir. Bu y\u00fczden TLS\u2019i do\u011fru yap\u0131land\u0131rmak, hem gizlilik hem de kurumsal itibar a\u00e7\u0131s\u0131ndan \u00f6nemlidir. \u00d6te yandan her al\u0131c\u0131n\u0131n ayn\u0131 politikay\u0131 uygulamad\u0131\u011f\u0131n\u0131 bilmek gerekir; baz\u0131 kurumlar TLS\u2019i zorunlu k\u0131lar, baz\u0131lar\u0131 ise sadece tercih eder. Bu da \u201cbaz\u0131 yerlere gidiyor, baz\u0131lar\u0131na gitmiyor\u201d \u015fikayetlerinde TLS sertifika hatalar\u0131n\u0131 olas\u0131 k\u00f6k nedenler aras\u0131na sokar.<\/p>\n<h2>Son kontrol: de\u011fi\u015fiklikten sonra neyi do\u011frulamal\u0131s\u0131n\u0131z?<\/h2>\n<ul>\n<li>MX hedefinizin do\u011fru hosta i\u015faret etti\u011fini<\/li>\n<li>Sunulan sertifikan\u0131n SAN i\u00e7inde MX host ad\u0131n\u0131 i\u00e7erdi\u011fini<\/li>\n<li>Intermediate zincirin eksiksiz g\u00f6nderildi\u011fini<\/li>\n<li>25\/587 gibi ilgili portlarda ayn\u0131 do\u011frulaman\u0131n ge\u00e7ti\u011fini<\/li>\n<li>SNI senaryolar\u0131nda do\u011fru sertifikan\u0131n se\u00e7ildi\u011fini<\/li>\n<li>Yenileme sonras\u0131 servislerin do\u011fru \u015fekilde yeniden y\u00fcklendi\u011fini<\/li>\n<\/ul>\n<p>MX1Mail gibi y\u00f6netilen i\u015f e-posta platformlar\u0131nda TLS ve sertifika taraf\u0131ndaki do\u011fru kurgu, e-posta ak\u0131\u015f\u0131n\u0131n daha sorunsuz \u00e7al\u0131\u015fmas\u0131na yard\u0131mc\u0131 olur. Yine de domaininizin MX hedefleri ve DNS de\u011fi\u015fiklikleri gibi alanlar sizin y\u00f6netiminizde oldu\u011fundan, sertifika-hostname uyumunu ve de\u011fi\u015fiklik sonras\u0131 kontrolleri operasyonel rutininize dahil etmek uzun vadede en az sorun \u00e7\u0131karan yakla\u015f\u0131md\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SMTP \u00fczerinde TLS\/STARTTLS sertifikas\u0131 nas\u0131l \u00e7al\u0131\u015f\u0131r? Zincir (chain), SNI, hostname uyumu ve yayg\u0131n sertifika hatalar\u0131n\u0131 te\u015fhis edip kal\u0131c\u0131 olarak \u00e7\u00f6zmek i\u00e7in pratik rehber.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[430,426,428],"class_list":["post-165","post","type-post","status-publish","format-standard","hentry","category-e-posta-guvenligi","tag-smtp-sorun-giderme","tag-starttls","tag-tls-sertifikasi"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=165"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/165\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}