On 2019-08-28 at 18:42 +0100, Tim Bray via mailop wrote: > Probably mainly for Debian users. > > libgnutls30 3.6.7-4 (Debian Buster) > > exim4-daemon-heavy 4.89-2+deb9u5 (Debian Stretch) > > Run these together and it tries to use TLS1.3 when sending email. And > google seems to close the connection straight away.
> I don't know why this is. But came around because I need to run the older > exim until I've solved another problem. > > exim4-daemon-heavy 4.92-8+deb10u1 from Debian Buster works fine. TLS1.3 > does work. TLS 1.3 is _different_ from TLS 1.2 in ways that 1.2 does not differ from 1.0 or 1.1. In particular, some important exchanges happen after the handshake. I forget the details right now. The effect is that application changes are needed to how the TLS APIs are used. It's not a drop-in upgrade. Newer releases of Exim have those changes. If you're using an older release, that will fail. I'd say that this is a packaging bug, if an OS has pulled in dependencies to enable a version of TLS which was not out of draft at the time that their version of the MTA was released. They'll need more patches backported. FWIW, mail from Gmail to Exim 4.92 with OpenSSL comes in as: X=TLSv1.3:TLS_AES_128_GCM_SHA256:128 while mail flowing out from Exim to Gmail negotiates: X=TLSv1.3:TLS_AES_256_GCM_SHA384:256 at least, in my configuration. -Phil, Exim Maintainer _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
