I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ...

1 Answer 1


Add to your main.cf:

# TLS Server
smtpd_tls_exclude_ciphers = RC4, aNULL
# TLS Client
smtp_tls_exclude_ciphers = RC4, aNULL
  • Why did you add the aNULL cipher to that list?
    – Marian
    Oct 3, 2016 at 20:43
  • 2
    To block anonymous DH and ECDH algorithms. It's not strictly necessary for this question, but typically you always want the server to be authenticated to avoid MITM attacks. Oct 3, 2016 at 21:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .