<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 12pt; font-family: Arial,Helvetica,sans-serif'>
<p>Am 2016-10-14 12:49, schrieb Guillaume REMBERT:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">For MTA, the advice is "better to keep poor encryption than<br /> nothing". I am fine with this, BUT part of the config indicated is then<br /> useless (and made me feel like I did something incorrect), isn'it?<br /> These 2 parameters are not used at all with the opportunistic TLS:<br /> - smtpd_tls_mandatory_ciphers=high<br /> - tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:\<br /> \EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS\<br /> \:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA</div>
</blockquote>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">No, smtpd_tls_mandatory_ciphers and the tls_high_cipherlist is NOT useless.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">In the BetterCrypto Config as explained it is used for MSA purposes. MSA = Mail Submission Agent => On the Submission Ports you only have Mail-Client to Server-Communication, and out there shouldn't be any old MailClient which doesn't support the high-cipherlist. And on the Submission-Ports Plaintext-Communication is disabled. So this makes sense.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
</body></html>