Re: smtpd and no DH parameters found in

2011-06-06 Thread Mikolaj Kucharski
On Sun, May 22, 2011 at 11:59:32PM +, Kevin Chadwick wrote: On Sun, 22 May 2011 23:12:21 +0100 Mikolaj Kucharski wrote: If I'm using 4096-bit RSA key, do I need to use 4096-bit size DH parameters file? No Do they need to match? No Is it okay to have DH smaller or even

Re: smtpd and no DH parameters found in

2011-05-22 Thread Mikolaj Kucharski
On Thu, May 19, 2011 at 07:58:55PM +, Kevin Chadwick wrote: On Thu, 19 May 2011 01:06:49 +0100 Mikolaj Kucharski wrote: On Thu, May 19, 2011 at 12:42:57AM +0200, Gilles Chehade wrote: smtpd is just telling you that you did not generate Diffie-Hellman parameters [see smtpd.conf(5) /

Re: smtpd and no DH parameters found in

2011-05-22 Thread Kevin Chadwick
On Sun, 22 May 2011 23:12:21 +0100 Mikolaj Kucharski wrote: If I'm using 4096-bit RSA key, do I need to use 4096-bit size DH parameters file? No Do they need to match? No Is it okay to have DH smaller or even bigger? Yes, some programs like dovecot manage it automatically so maybe?

Re: smtpd and no DH parameters found in

2011-05-19 Thread Kevin Chadwick
On Thu, 19 May 2011 01:06:49 +0100 Mikolaj Kucharski wrote: On Thu, May 19, 2011 at 12:42:57AM +0200, Gilles Chehade wrote: smtpd is just telling you that you did not generate Diffie-Hellman parameters [see smtpd.conf(5) / starttls(8)], and that it will use its own builtin parameters.

Re: smtpd and no DH parameters found in

2011-05-18 Thread Gilles Chehade
On Wed, May 18, 2011 at 11:27:14PM +0100, Mikolaj Kucharski wrote: Hi, I have smtpd(8) setup on one of my machines with TLS enabled. Each time I start /usr/sbin/smtpd (as root) I'm getting following message: no DH parameters found in /etc/mail/certs/re0.dh using built-in DH

Re: smtpd and no DH parameters found in

2011-05-18 Thread Mikolaj Kucharski
On Thu, May 19, 2011 at 12:42:57AM +0200, Gilles Chehade wrote: smtpd is just telling you that you did not generate Diffie-Hellman parameters [see smtpd.conf(5) / starttls(8)], and that it will use its own builtin parameters. It is safe to ignore the message, but it is safer to actually