I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones.

My desired set of ciphers is (taken from nginx configuration):

```
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:-DES:!RC4:!MD5:!PSK:!aECDH:EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
```

Unfortunately I cannot find a reference to override the cipher suites. I found notices that it is possible but not how.

How would look like the equivalent Postfix configuration for `smtp`

and `smtpd`

?

Using Debian/7, Postfix/2.11.2, OpenSSL/1.0.1e

Don't do this.You will actually reduce the security of your email in transit. The reason is that if another mail server that speaks to yours doesn't support any of the ciphers you have specified, then TLS will fail entirely. The message will then be sent withnoencryption, rather than simplyweakcrypto. – Michael Hampton Feb 21 '15 at 10:12