The site weakdh.org explains how to fix postfix against the weak Diffie-Hellman attack called "logjam".

But don't I have to fix courier too? Or do I have to migrate to dovecot to be logjam-safe?

  • Already this is a good guide for checking a generic service. – Marki May 21 '15 at 20:05

I found this blog post that explains it quite well.

To speed this up, first check, if you already have good parameters in /etc/ssl/certs/dhparams.pem check with

openssl dhparam -text -noout -in /etc/ssl/certs/dhparams.pem

if so copy them into /etc/courier/dhparams.pem with

cp -a /etc/ssl/certs/dhparams.pem /etc/courier/dhparams.pem

otherwise generate with

openssl dhparam -out /etc/courier/dhparams.pem 4096

Courrier version 4.15 removes the TLS_DHCERTFILE parameter from imap, and pop3d configuration files. DH parameters, and DH parameters only, get read from the new TLS_DHPARAMS file (and the other functionaly of TLS_DHCERTFILE, for DSA certificates, is merged into TLS_CERTFILE). After upgrading, run the mkdhparams script to create a new TLS_DHPARAMS file.

So check your installed version with

 apt-cache show courier-imap-ssl|grep Version

If you have at least Version 4.15, now edit /etc/courier/imapd-ssl and set


restart courier-imap-ssl:

/etc/init.d/courier-imap-ssl restart

check the connection with openssl version 1.0.2a.

openssl s_client -host <yourhost.org> -port 993

When using courier, you need to make sure that Diffie-Hellman parameters in /etc/courier/dhparams.pem are generated with more than the default 768 bit. I guess 2048 or 4096 bit should do.

Instead of using mkdhparams to generate dhparams.pem (with just 768 bit by default!) you could do it that way:

openssl dhparam -out /etc/courier/dhparams.pem 2048

service courier-mta-ssl restart 

Here's some info (in German) and some further reading about how to mitigate the Logjam-attack on Courier-MTA.

  • Unlike the Postfix daemon the Courier POP3 and IMAP daemons require the certificate and key to have been combined into a single file. courier uses TLS_CERTFILE=/etc/courier/imapd.pem in their settings in /etc/courier/imapd-ssl so there has to be done some more i guess. (see blog.mekk.com/2010/06/… ) – rubo77 Jun 9 '15 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.