1

I have a dovecot server running that enforces TLS1.2

ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2

This used to work fine until someone tried to connect with an iPhone which complains that the server is not responding and I see according log messages on the server:

imap-login: Error: SSL: Stacked error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

I figured out that it works just fine if I allow TLSv1. Is this for real? I found other people complaining about it (http://www.clift.org/fred/frustration-with-apple-mail-app-on-ios-and-yosemite.html) but I can't really believe it. Please tell me that I'm missing something obvious. Is TLSv1.2 only supported with special ciphers for instance?

Here is my ssl config for completes:

$ egrep -v "^#|^$" /etc/dovecot/conf.d/10-ssl.conf 
ssl = yes
ssl_cert = </etc/ssl/my_certs/mail.xyz.tld.crt
ssl_key = </etc/ssl/my_certs/mail.xyz.tld.key
ssl_dh_parameters_length = 2048
ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
ssl_prefer_server_ciphers = yes

Please, someone wake me up and tell me that this is just a bad dream...

Thanks for your help!

  • I don’t know when this happend exactly, but the current version (10.3.1?) finally support TLS 1.2. – Maximilian Kaul Apr 6 '17 at 9:45
2

I wish I could pinch you to wake you up, but sadly, this is not a dream. The iOS Mail app cannot speak any later TLS than TLSv1. Not even 1.1 (which is ok by PCI.) Apple has really dropped the ball on this one. The Mail app supports TLS1.1 and 1.2 for SMTP, but not POP3 or IMAP. It looks as if people have been complaining to Apple about this for at least a year, but to no effect so far.

  • 2
    This finally got fixed in iOS 10. – Steve Lionel Apr 4 '17 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.