I have a dovecot server running that enforces TLS1.2
ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2
This used to work fine until someone tried to connect with an iPhone which complains that the server is not responding and I see according log messages on the server:
imap-login: Error: SSL: Stacked error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
I figured out that it works just fine if I allow TLSv1
. Is this for real? I found other people complaining about it (http://www.clift.org/fred/frustration-with-apple-mail-app-on-ios-and-yosemite.html) but I can't really believe it. Please tell me that I'm missing something obvious.
Is TLSv1.2
only supported with special ciphers for instance?
Here is my ssl config for completes:
$ egrep -v "^#|^$" /etc/dovecot/conf.d/10-ssl.conf
ssl = yes
ssl_cert = </etc/ssl/my_certs/mail.xyz.tld.crt
ssl_key = </etc/ssl/my_certs/mail.xyz.tld.key
ssl_dh_parameters_length = 2048
ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
ssl_prefer_server_ciphers = yes
Please, someone wake me up and tell me that this is just a bad dream...
Thanks for your help!