diff --git a/tasks/main.yml b/tasks/main.yml
index b4db040..c1be102 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -10,6 +10,11 @@
   notify:
     - reload dovecot
 
+- name: postfix user
+  user:
+    name: postfix
+    groups: ssl-cert
+
 - name: vmail group
   group:
     name: vmail
diff --git a/templates/conf.d/10-ssl.conf.j2 b/templates/conf.d/10-ssl.conf.j2
index ab2dc01..d5b9aff 100644
--- a/templates/conf.d/10-ssl.conf.j2
+++ b/templates/conf.d/10-ssl.conf.j2
@@ -3,14 +3,14 @@
 ##
 
 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
-ssl = no
+ssl = yes
 
 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-#ssl_cert = </etc/dovecot/dovecot.pem
-#ssl_key = </etc/dovecot/private/dovecot.pem
+ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
+ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often
@@ -21,7 +21,7 @@ ssl = no
 # PEM encoded trusted certificate authority. Set this only if you intend to use
 # ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
 # followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
-#ssl_ca = 
+#ssl_ca =
 
 # Require that CRL check succeeds for client certificates.
 #ssl_require_crl = yes