Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When running PCI security scans on this server it fails on port 25 with:

SSL Server Supports Weak Encryption nCircle ID: 6174 Port: 25 CVSS Score: 5.8 Not Compliant Description The SSL (Secure Socket Layer) Server supports weak encryption keys, which are defined as encryption keys with lengths of less than 128 bits. Messages encrypted with weak encryption keys are relatively easy for an unauthorized user to decrypt.

I have tried modifying /etc/postfix/ with various changes:

  • postconf -e smtpd_tls_mandatory_protocols="SSLv3,TLSv1"
  • postconf -e smtpd_tls_mandatory_ciphers="high"
  • postconf -e smtpd_tls_exclude_ciphers="SSLv2,aNULL,ADH,eNULL"

No luck. This is the only port which fails the scan. My web and IMAP pots are all fine.

Any suggestions appreciated.

share|improve this question
Did you restart or HUP the postfix SMTP process after your configuration changes? – brent Sep 7 '10 at 16:16

One document I found recommends the following settings for PCI compliance:

postconf -e smtpd_tls_ciphers=medium
postconf -e smtpd_tls_protocols=\!SSLv2
postconf -e smtpd_tls_mandatory_ciphers=high
postconf -e smtpd_tls_exclude_ciphers="aNULL, MD5, DES"

Then restart the postfix daemon for good measure.
The document is actually for an unrelated VMWare product, but postfix is postfix, right?


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.