location of postfix ssl certificates

[Ruben Kerkhof]

Hi all,

I was wondering what would be the best place to store tls certificates
for postfix.
Right now, we store them in /var, which is denied by the policy.

The policy allows postfix files_read_usr_files (for openssl, that's
what the comment above it says) but wouldn't it be better to store
them under /etc/pki?
Maybe there should be a postfix_cert_t or something?

Regards,

Ruben