I'm getting ready to deploy a new SMTP server, and I'm not sure how to ensure that it is using strong encryption. The server software is Postfix running only SMTP. I've added the following to the
main.cf file (stolen from here):
smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 smtpd_tls_security_level = encrypt smtpd_tls_mandatory_protocols = TLSv1 # Also available with Postfix ≥ 2.5: smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
Restarted the daemon and everything seems to work as intended, but I'm not sure how to test that only the strong cyphers are enabled. The following allows me to connect, but I'm not sure which combination of flags (
-no_tls1, etc) to use in order to ensure that only the strong encryption is enabled.
openssl s_client -starttls smtp -crlf -connect mail.mysite.com:25