I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ...
1 Answer
Add to your main.cf:
# TLS Server
smtpd_tls_exclude_ciphers = RC4, aNULL
# TLS Client
smtp_tls_exclude_ciphers = RC4, aNULL
-
-
2To block anonymous DH and ECDH algorithms. It's not strictly necessary for this question, but typically you always want the server to be authenticated to avoid MITM attacks. Oct 3, 2016 at 21:56