0

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL...

While this process went smoothly for HTTPS, it seems that Dovecot & Postfix reject (or drop, rather - since the connection attempts time out) mail clients' attempts to connect over TLS ---

However, when I run :

openssl s_client -connect {our IP}:465 -tls1_2 // also on works on 993

It returns: 

CONNECTED
[...]
New, TLSv1/SSLv3, Cipher is [...]
Server public key is 4096 bit
[...]
SSL-Session:
    Protocol  : TLSv1.2
    [...]

In /etc/postfix/main.cf, the relevant lines read:

smtpd_use_tls = yes
[...]
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

In /etc/dovecot/${grep -l -R 'tls'} - the only relevant lines are uncommented are: 

ssl_cert = </etc/dovecot/dovecot.pem
ssl_key = </etc/dovecot/private/dovecot.pem

Which, after looking at the rest of the file, I'm not sure how SSL ever worked with Dovecot --- but it has - !

I'm sure that I just have a simple misunderstanding of how this works and that there is a small piece of information that I'm missing which will perfectly explain why openssl s_client shows positive results, while nothing else can connect via TLS...

So, I appreciate your insight on this -

Improve this question
4
  • So what makes you think the connection doesn't work?
    – gparent
    Oct 22, 2014 at 16:47
  • Mail clients (Outlook and the default HTC mail client) time out trying to connect when explicitly configured to use TLS instead of SSL...
    – rm-vanda
    Oct 22, 2014 at 16:48
  • Which version of Outlook on what version of Windows?
    – gparent
    Oct 22, 2014 at 16:50
  • Outlook 2013 on Windows 8.1 -- That's the only instance of Outlook I've tested, so far. But that is the setup of half our machines. The rest will be varying combinations of Windows 7/8 with Outlook 2013/2010 --- and Android + iOS devices.
    – rm-vanda
    Oct 22, 2014 at 16:53

1 Answer 1

Reset to default
1

Not all applications are updated to TLS 1.2. My SMTP logs indicate about a 50/50 split between TLS 1.0 and TLS 1.2. That likely overstates the adoption of TLS 1.2 as my internal serves use TLS 1.2.

Try running your tests with -ssl3, -tls1, and tls1_1 as well as -tls1_2. For now only -ssl3 should fail. That should enable most modern clients connect.

I disabled SSLV3 on my servers last week-end. I run Dovecot, Apache, and Exim, so I don't have instructions for Postfix. For Dovecot I used:

ssl_protocols = !SSLv3 !SSLv2
Improve this answer
2
  • Thank you for the insight - ! - However, the mail clients we are using, like Outlook, don't allow you to specify which version of TLS to use when connecting - instead, the connection simply times out - I have the directives to disable SSL in dovecot and postfix, but Im afraid to do this until the clients that force you to choose one over the other are set to connect via TLS ---
    – rm-vanda
    Oct 23, 2014 at 13:45
  • 1
    @rm-vanda you usually don't specify which crypto-layer protocol the clients should use, or better: which version of TLS should be used. This is negotiated at the beginning of the session with the supported ciphers etc on both sides (POODLE depends on exactly this behavior).
    – sebix
    Oct 23, 2014 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .