2

I recently migrated my main mail server to a new one, the old one had been running for almost 10 years and was the production server for around 20 domains and over 40 mailboxes.

Everything went well and the configuration is not that much different from the old one, postfix and dovecot are though more recent.

One issue I am having though is to enable at least TLSv1.1 for compatibility reasons. I am seeing in the logs many TLS related connection errors and I have a stubborn client who is using Apple Mail in El Capitain that does not support TLSv1.2.

I need to have this enabled for at least one year to give time for upgrades. Problem is no matter what I specify in the postfix main.cf it will only serve TLSv1.2 and up.

    smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
    smtpd_tls_protocols = !SSLv2, !SSLv3

and

    smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
    smtp_tls_protocols = !SSLv2, !SSLv3

but if I test with testssl.sh I always get

     Testing protocols via sockets 
    
     SSLv2      not offered (OK)
     SSLv3      not offered (OK)
     TLS 1      not offered
     TLS 1.1    not offered
     TLS 1.2    offered (OK)
     TLS 1.3    offered (OK): final

on port 25, submission or smtps. Is there anything I missed on centos8 to enable TLSv1.1?

Edit: If I specify this for the smptd

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, TLSv1, TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, TLSv1, TLSv1.1

Testing result is:

 Testing protocols via sockets 

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      not offered
 TLS 1.1    not offered
 TLS 1.2    not offered
 TLS 1.3    offered (OK): final

So now it disables TLSv2? Am I doing something wrong in the config file? I know syntax changed in 3.6 but this one should work too.

2
  • You've given him FOUR years already. I wouldn't have much sympathy if he wants to keep using ancient Macs from the 2000s. That said, did you actually try specifying TLS 1.1? Nov 29, 2020 at 18:02
  • I was trying to answer here, I edited my question with some details... And for my client, the issue is that I see a bunch of others clients or smtp servers that don't support TLS higher than 1.1 and before cutting everybody off I want to make sure to at least have a grace period where I can keep an eye on things. Also I just made the migration and this only person complained but I am seeing others so I suspect I will get some phone call next week..
    – moray
    Nov 29, 2020 at 18:33

1 Answer 1

3

@moray try setting your CentOS crypto policy to LEGACY:

update-crypto-policies --set LEGACY

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening

Regarding the RedHat article this enables TLSv1.0 / TLSv1.1. After setting this just restart your postfix and your mails will be delivered.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .