How to disable client-initiated renegotiation in Postfix?

1 Answer 1


In console:

nano etc/postfix/main.cf

Find & edit - or add this line:

tls_ssl_options = NO_RENEGOTIATION

The value of the tls_ssl_options configuration parameter is a white-space or comma separated list of named options, with an alternate syntax provided for (only in exceptional circumstances recommendable) directly specifying OpenSSL-supported options not (yet) named at Postfix compile time.

  • Do you know how to do it in postfix 2.10 ? Commented Jun 1, 2022 at 18:28
  • Because TLS 1.3 forbids renegotiation, this is only needed when allowing legacy TLS (1.2 or prior) in the first place.
    – anx
    Commented Jun 1, 2022 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .