Gary,
https://www.immuniweb.com/ssl/ <https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.immuniweb.com%2fssl%2f%3fid%3d3lEgRGsj&c=E,1,qDvtiO36lhAC13PjMxSyLGkfUjX5sKv58T1QsgXFdAHPdyQFJZ2NX-GSwGOGzumTdFRh7gOwpMK1b1EJW4A_OD7-dxdLjFOlCHimYsyk&typo=0> is perfect way to test. I think everyone agrees, we just don’t want to set it “X” and assume it’s the best. Since Dovecot can use a different encryption list than Qmail, that’s why you need to test each port. I think you got the main idea of it now. Carl From: Gary Bowling [mailto:[email protected]] Sent: Wednesday, September 04, 2019 10:50 AM To: [email protected] Subject: Re: [qmailtoaster] SSL Problem Dovecot Yes it's a bit tricky for sure. Phones for email, which I have a lot of. I have a customer with a fax machine that emails faxes, so it has an email account configured in it. All these things run TLSv1 and aren't things I can dictate go away. I also found that squirrelmail uses TLSv1 and ECDHE-RSA-AES256-SHA. Since it's logging in from 127.0.0.1 to 127.0.0.1 it's not a problem. But it IS a problem for setting these things in the server. At this point, I have NO ssl_cipher_list configured in dovecot, so it's using whatever the default is. I set it back this way (that's what it was when I started this exercise) because everything I configured caused me problems. I need to leave the users alone for a bit so they can get some work done :) With it set this way, I scanned my server using https://www.immuniweb.com/ssl/ <https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.immuniweb.com%2fssl%2f%3fid%3d3lEgRGsj&c=E,1,qDvtiO36lhAC13PjMxSyLGkfUjX5sKv58T1QsgXFdAHPdyQFJZ2NX-GSwGOGzumTdFRh7gOwpMK1b1EJW4A_OD7-dxdLjFOlCHimYsyk&typo=0> Looks like it scans both the mail protocols and the web protocols. The only big problem is shows is the use of TLSv1, which I'm not sure I can do anything about at this point. There are a few other things it points out that I need to look in to.. - Doesn't support TLSv1.3. Not sure I can do anything about this one as I would assume it requires an update to openssl. - The server does not prefer cipher suites. Need to do some research on this one. - The server does not enforce HTTP Strict Transport Security. FIXED by adding the following to my virtualhost. Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;" Gary
