Hi
I am getting lots of SSL_accept errors in the mail log files as a result of not being able to receive mail from certain servers. I think this is because of the sending servers not supporting ECDSA certificates which is what Lets Encrypt uses as far as I know and is what I am using on Postfix.
I have smtpd_tls_security_level=may so I am not forcing using TLS
Any ideas or a potential workaround ?
I don’t know if that’s actually the problem but Let’s Encrypt does provide RSA certificates as well, and most ACME clients will request RSA certificates by default unless you explicitly ask for ECDSA…
Not without a lot more info. E.g., the relevant smtpd_tls_* directives of your main.cf and the hostname of the mailserver.
I just checked and the cert is actually RSA but one of the the signature algorithms is ECDSA. So whether that is the issue I have no idea.
Hostname is mail.snapto.co.uk
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_use_tls = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_cert_file = /etc/letsencrypt/live/snapto.co.uk/cert.pem
smtpd_tls_key_file = /etc/letsencrypt/live/snapto.co.uk/privkey.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/snapto.co.uk/fullchain.pem
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1
smtpd_tls_mandatory_ciphers = high
tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
A few things:
You might temporary try to raise this to 2, so you'll get TLS negotiation warning/errors.
This should be set to fullchain.pem, which would make:
unnecessary.
Although smtpd_tls_CAfile can be used to provide a intermediate certificate, it isn't necessary, as smtpd_tls_cert_file can just use the whole fullchain file.
Perhaps some older mail transfer agents can only use protocols older than TLSv1.1?
I would suggest increasing the TLS log level first and see what really makes the negotiation fail.
You may be able to use both (an RSA and an ECDSA cert).
[although I don't think that would relieve this specific problem]
A more likely cause is the preferred use of DHE ciphers with 1024 bit DH primes.
I tried not using the cipher list and made no difference
TLS v1 is now marked as insecure. The sending server I am having issues with is using TSv1.2 anyhow. The log level I already changed thanks.
What does this mean?
[please explain more]
Re Cypher list I just commented it out.
That will remove all ciphers.
Nothing will work then.
temporarily try:
cypher list=ALL;
Yes it does it uses the standard cyphers.
I think I have located the issue to the sending server using out of date cyphers.
Sounds a lot like what was said earlier in this thread…
But I’m glad you found it.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.