How to disable client-initiated renegotiation in Postfix?
1 Answer
In console:
nano etc/postfix/main.cf
Find & edit - or add this line:
tls_ssl_options = NO_RENEGOTIATION
The value of the tls_ssl_options
configuration parameter is a white-space or comma separated list of named options, with an alternate syntax provided for (only in exceptional circumstances recommendable) directly specifying OpenSSL-supported options not (yet) named at Postfix compile time.
-
-
Because TLS 1.3 forbids renegotiation, this is only needed when allowing legacy TLS (1.2 or prior) in the first place.– anxJun 1, 2022 at 18:49