Re: [exim] Define preferred encryption algorithms

Página Inicial
Delete this message
Reply to this message
Autor: jmedard
Data:  
Para: exim-users
Assunto: Re: [exim] Define preferred encryption algorithms
Hello,
Thank you for your answer.
Yes, I am talking about EXIM with the use of OpenSSL.
I understand that EXIM is limited to the specifications of the OpenSSL
library.
Regards
JME

-----Message d'origine-----
De : Exim-users <exim-users-bounces+jmedard=amv-sa.fr@???> De la part
de Jeremy Harris via Exim-users
Envoyé : vendredi 11 octobre 2019 11:55
À : exim-users@???
Objet : Re: [exim] Define preferred encryption algorithms

On 10/10/2019 15:30, jmedard--- via Exim-users wrote:
> On Exim the order of the encryption string, present in

"tls_require_ciphers"
> does not matter, the order is not used.
>
>
>
> I think this requires the switch to "Server preference", via the
> openssl_options: "+cipher_server_preference", but it is not enough for
> the server to define a recommended encryption algorithm.
>
>
>
> How is it possible to define a cipher algorithm preference, please?


Since you mention openssl_options I'm assuming you are using an Exim built
for use with OpenSSL. Please doublecheck this, as it affects the answer.

We are limited by what the library provides.

The openssl_options are fed to the SSL_CTX_set_options() interface (via some
fairly-obvious processing). The tls_require_ciphers is fed to
SSL_CTX_set_cipher_list().


http://exim.org/exim-html-current/doc/html/spec_html/ch-encrypted_smtp_conne
ctions_using_tlsssl.html#SECTreqciphssl

talks about order of the list of ciphers, which to me implies that the
library uses that order as a preference.
--
Cheers,
Jeremy

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/